GitLab patches a critical unauthenticated code-execution flaw

GitLab’s critical patch release fixes an integer overflow in regular-expression compilation that could allow unauthenticated remote code execution under certain conditions. Fixes cover several maintained CE and EE branches, including backports to 18.11.13, 19.0.10, 19.1.9 and 19.2.9. GitLab.com is already patched. Self-managed operators need to match their deployed branch to the fixed version rather than assuming authentication settings remove the risk.

GitLab · Oct 21, 2026

Why it matters

The vulnerable operation can occur before an attacker has an account, making timely server updates the relevant control.

More context

The notice also lists 19.3.6, 19.4.3 and 19.5.1 as fixed releases. Use its affected-version table and normal upgrade procedure, including backup and compatibility checks. GitLab provides detection guidance for native-worker crashes and rendering-error bursts.

Keep in mind

The advisory describes a possible execution path, not proof your installation was exploited. Other fixes in the release have different affected-version ranges and configuration requirements.

Original read