[TLP:CLEAR] GitLab fixes a high severity vulnerability

GitLab is fixing a high severity vulnerability in GitLab Community Edition and Enterprise Edition with versions 19.5.4, 19.4.6 and 19.3.8. Important guidance for self-compiled GitLab installations can be found here [1]. We also draw attention to the previous release of versions (19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, 18.11.14), which removed trust for eight compromised eMudhra intermediate CA certificates. If you use the self-hosted version of Runners or AI Gateway, you must also upgrade those components to the latest versions [2].

GitLab - RCE (CVE-2026-105437)
CVSS 7.5 (High)

Unauthenticated remote attacker is under certain conditions able to execute arbitrary commands within GitLab's Gitaly environment by submitting specially crafted repository content (e.g. a branch in a merge request) whose three-way merge, performed on the server, triggers a heap-based buffer overflow in Git [1][3]. Details about detecting exploitation attempts of this vulnerability can be found here [4].

The vulnerability is present in product:

  • GitLab; >=16.2, <19.3.8; >=19.4, <19.4.6; >=19.5, <19.5.4;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 10. 11. 2026.

By CESNET, z.s.p.o. Martin Krajči on 11. 11. 2026.

CESNET, z.s.p.o. Logo