I’M UNDER A CYBER ATTACK

Alert

Logo de GitLab

Alert 2026-155 Heap overflow in Git bundled with GitLab allows command execution in Gitaly

Affected product(s): 

ProductAffected versionsFixed in
GitLab Community Edition and Enterprise Edition (self-managed)All versions from 16.2 before 19.3.8, 19.4 before 19.4.6, and 19.5 before 19.5.419.3.8, 19.4.6, and 19.5.4
GitLab.com and GitLab DedicatedAlready running a patched versionNo customer action required

Today, patches are available only in the 19.3, 19.4, and 19.5 branches; anyone running 16.2 through 19.2 must follow the vendor’s upgrade path to an already patched supported branch.

Description

Security updates 19.5.4, 19.4.6, and 19.3.8 of GitLab Community Edition and Enterprise Edition have been released, fixing CVE-2026-105437, a heap buffer overflow in the Git bundled with the platform. The product advisory, dated Nov 10, 2026, rates it as critical: in GitLab, under certain conditions, this flaw can be used to execute arbitrary commands in the Gitaly environment. The CVE record, issued by the vendor itself, assigns it a CVSS 3.1 score of 7.5, High; at the time of publication, that is the score reproduced by public catalogs, with no additional independent assessment.

The issue is in Git’s three-way merge code. In GitLab, it is fixed by updating the bundled Git. A typical scenario is that someone with permission to push and open a merge request triggers the overflow when the server checks whether the branches can be merged, without anyone else having to intervene. Self-managed CE/EE installations from 16.2 up to but not including 19.3.8, 19.4.6, and 19.5.4 are affected, across the common deployment types. GitLab.com and GitLab Dedicated are already patched and require no action.

On user-compiled installations, the official Linux packages and container images already ship with patched Git, but the Git binaries embedded in Gitaly and the Git referenced by the configuration must also be rebuilt. If that Git comes from the distribution package, upgrade to 2.56.1 or later, or to a version that the distribution has patched for this CVE. If an immediate update is not possible, the CVE record—not the Nov 10, 2026 patch page—describes a temporary mitigation: add “* conflict-marker-size=7” to the info/attributes file in each repository, or disable mergeability checks on the server for untrusted repositories. This does not replace the patch.

No known exploitation or public proof of concept was identified for CVE-2026-105437. GitLab’s advisory does not report any, and as of Nov 10, 2026, the flaw does not appear in catalogs of known exploited vulnerabilities. This CVE is distinct from the two critical October issues (CVE-2026-97229 and CVE-2026-110264) covered in earlier alerts: the patches for those advisories do not fix this one, and you must be running 19.5.4, 19.4.6, or 19.3.8. Versions 19.5.1 and 19.5.3 are not sufficient for this flaw. The vendor previously stated that versions 19.5.2 and 19.4.4 do not exist.

Mitigation

It is recommended to inventory self-managed GitLab CE/EE instances and their versions. GitLab.com and GitLab Dedicated require no action. Upgrade to 19.5.4, 19.4.6, or 19.3.8, depending on the branch. If the instance is running 19.2 or earlier, within the range starting at 16.2, follow the vendor’s upgrade path to an already patched supported branch; there is no 19.2.x release in today’s batch.

On user-compiled installations, rebuild the Git used by Gitaly and the Git referenced by the configuration, or update the distribution’s Git to 2.56.1 or the distribution’s patched version. If an immediate update is not possible, apply the temporary mitigation described in the CVE record (conflict-marker-size=7 in info/attributes in each repository, or disable mergeability checks for untrusted repositories). This is not a substitute for the patch.

The vendor did not publish indicators of compromise for this CVE. Do not reuse indicators from earlier advisories as if they applied to this flaw. The patch does not undo a previous compromise.

GitLab security patches in recent weeks

This advisory does not replace the October ones: an instance may need to have applied those patches and also reach 19.5.4, 19.4.6, or 19.3.8. The table summarizes the confirmed security releases on the vendor’s patch pages from October to today.

DateVersionsWhat it covers
Oct 2, 2026AI Gateway 19.4.1CVE-2026-90970, command execution in AI Gateway. The vendor-hosted gateways were already fixed. This is not a GitLab CE/EE patch.
Oct 12, 2026CE/EE 19.4.2, 19.3.5, and 19.2.8CVE-2026-97229, critical, CVSS 10.0, remote code execution in CI/CD (Alert 2026-131). The batch includes other flaws.
Oct 21, 2026CE/EE 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13CVE-2026-110264, critical, CVSS 10.0, unauthenticated remote code execution (Alert 2026-118). The 12/10 patches do not fix it.
Oct 29, 2026CE/EE 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, and 18.11.14CVE-2026-111943: stops trusting compromised intermediate certificates. Runner 19.5.1 must also be updated and, if used, the self-hosted AI Gateway. The advisory states that 19.5.2 and 19.4.4 do not exist.
Nov 10, 2026CE/EE 19.5.4, 19.4.6, and 19.3.8CVE-2026-105437 (this advisory). Versions 19.5.1 and 19.5.3 do not address it.

The earlier GitLab alerts and the vendor’s patch advisories are listed below and under Additional information.

Alert 2026-118 Critical GitLab vulnerability allows unauthenticated RCE

Alert 2026-131 Critical GitLab vulnerability (CVE-2026-97229) allows RCE and is being actively exploited

GitLab — patch 19.5.4 / 19.4.6 / 19.3.8 (Nov 10, 2026)

GitLab — patch 19.5.3 / 19.4.5 / 19.3.7 (Oct 29, 2026)

GitLab — patch 19.5.1 and related branches (Oct 21, 2026)

GitLab — patch 19.4.2 / 19.3.5 / 19.2.8 (Oct 12, 2026)

GitLab — AI Gateway 19.4.1 (Oct 2, 2026)

Solution

The solution is to update self-managed GitLab CE/EE instances to 19.5.4, 19.4.6, or 19.3.8 and, on user-compiled installations, also rebuild or update the Git used by Gitaly and the Git referenced by the configuration. GitLab.com and GitLab Dedicated require no action.

For information on how to upgrade, visit the following link:

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-4-released/

Additional information: