GitLab critical patch release
artooro
298 points
71 comments
October 21, 2026
Related Discussions
Found 5 related stories in 134.2ms across 10,209 title embeddings via pgvector HNSW
- Upcoming critical PHP security release xd · 412 pts · October 20, 2026 · 51% similar
- GitLab Outage kunley · 60 pts · September 24, 2026 · 51% similar
- Upcoming Critical PHP Security Release choult · 117 pts · October 20, 2026 · 51% similar
- Rate limits on GitLab.com are changing darkwater · 163 pts · September 17, 2026 · 50% similar
- Government Rails Site Hit Hours After CVE Patch rietta · 84 pts · September 04, 2026 · 48% similar
Discussion Highlights (14 comments)
tptacek
"CVSS 10.0" isn't in the headline here and a CVSS of 10 doesn't actually mean anything.
beaconflint
If you're patching a fleet, gitlab-rake gitlab:env:info gives you the exact version per node, faster than guessing from the omnibus package name.
Thaxll
What a great week security wise!
perlgeek
Back in perl 5.8 and older, the regex engine worked by recusing at the level of C functions, and so you could trigger stack overflows by giving it large strings. Is this similar? I wonder why gitlab even has its own regex compiler. Or is this a vulnerability in an underlying library or programming language?
jimmyl02
Awesome find by https://hackerone.com/joaxcar and it's a little bit frightening that this severe of a bug isn't the biggest security vulnerability of today
bon0r
possible bug? or too soon to check? :) after updating a pop-up still shows: "You are currently on version 19.5.1! We strongly recommend upgrading your GitLab installation immediately." while 19.5.1 should be the latest and fixed version
minraws
I am concerned for my self hosted servers, well only hope is tailscale should be entirely secure, and egress is filtered heavily... If that doesn't work my home lab is fucked. Any suggestions folks, not even my terminally online self can handle all of these.
ezekg
Is this a bug in GitLab or in Ruby? It's hard to tell from the report and the patch...
miduil
At least second regex related CVE in GitLab in the past few weeks. Awful to see that the endpoint is reachable unauthenticated, but I'm glad that they provide guidance in how to check the logs for attempts of exploitation
hobofan
This is shaping up to be the single worst security news day ever. Given the role that AI played in some of the discoveries, one has to wonder if this marks the start of some dark age of IT security.
131hn
Using AI agent to apply patches & upgrade is now mandatory to keep up with the pace.
jaequery
is this a taste of things to come?
muvlon
The critical CVE ( https://docs.gitlab.com/releases/patches/patch-release-gitla... ) seems embargoed, just saying that it involves integer overflow in a regex compiler. Coincidentally, there is also a (non-embargoed) musl libc CVE published today involving integer overflow in its regex compiler: https://www.openwall.com/lists/musl/2026/10/21/1 Perhaps that is the underlying bug, or a similar one turned up by the same security research?
yoyohello13
Gitlab has had a lot lately. I’ve had to patch every other week for the last few months