{"id":12548,"date":"2026-11-10T18:36:15","date_gmt":"2026-11-11T00:36:15","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-155-git-heap-overflow-allows-command-execution-in-gitaly\/"},"modified":"2026-11-10T18:41:34","modified_gmt":"2026-11-11T00:41:34","slug":"alert-2026-155-heap-overflow-in-git-bundled-with-gitlab-allows-command-execution-in-gitaly","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-155-heap-overflow-in-git-bundled-with-gitlab-allows-command-execution-in-gitaly\/","title":{"rendered":"Alert 2026-155 Heap overflow in Git bundled with GitLab allows command execution in Gitaly"},"content":{"rendered":"\n

Affected product(s):\u00a0<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td>Fixed in<\/strong><\/td><\/tr>
GitLab Community Edition and Enterprise Edition (self-managed)<\/strong><\/td>All versions from 16.2 before 19.3.8, 19.4 before 19.4.6, and 19.5 before 19.5.4<\/td>19.3.8, 19.4.6, and 19.5.4<\/td><\/tr>
GitLab.com and GitLab Dedicated<\/strong><\/td>Already running a patched version<\/td>No customer action required<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Today, patches are available only in the 19.3, 19.4, and 19.5 branches; anyone running 16.2 through 19.2 must follow the vendor’s upgrade path to an already patched supported branch.<\/p>\n\n

Description<\/h2>\n\n

Security updates 19.5.4, 19.4.6, and 19.3.8 of GitLab Community Edition and Enterprise Edition have been released, fixing CVE-2026-105437, a heap buffer overflow in the Git bundled with the platform. The product advisory, dated Nov 10, 2026, rates it as critical: in GitLab, under certain conditions, this flaw can be used to execute arbitrary commands in the Gitaly environment. The CVE record, issued by the vendor itself, assigns it a CVSS 3.1 score of 7.5, High; at the time of publication, that is the score reproduced by public catalogs, with no additional independent assessment.<\/p>\n\n

The issue is in Git’s three-way merge code. In GitLab, it is fixed by updating the bundled Git. A typical scenario is that someone with permission to push and open a merge request triggers the overflow when the server checks whether the branches can be merged, without anyone else having to intervene. Self-managed CE\/EE installations from 16.2 up to but not including 19.3.8, 19.4.6, and 19.5.4 are affected, across the common deployment types. GitLab.com and GitLab Dedicated are already patched and require no action.<\/p>\n\n

On user-compiled installations, the official Linux packages and container images already ship with patched Git, but the Git binaries embedded in Gitaly and the Git referenced by the configuration must also be rebuilt. If that Git comes from the distribution package, upgrade to 2.56.1 or later, or to a version that the distribution has patched for this CVE. If an immediate update is not possible, the CVE record\u2014not the Nov 10, 2026 patch page\u2014describes a temporary mitigation: add \u201c* conflict-marker-size=7\u201d to the info\/attributes file in each repository, or disable mergeability checks on the server for untrusted repositories. This does not replace the patch.<\/p>\n\n

No known exploitation or public proof of concept was identified for CVE-2026-105437. GitLab’s advisory does not report any, and as of Nov 10, 2026, the flaw does not appear in catalogs of known exploited vulnerabilities. This CVE is distinct from the two critical October issues (CVE-2026-97229 and CVE-2026-110264) covered in earlier alerts: the patches for those advisories do not fix this one, and you must be running 19.5.4, 19.4.6, or 19.3.8. Versions 19.5.1 and 19.5.3 are not sufficient for this flaw. The vendor previously stated that versions 19.5.2 and 19.4.4 do not exist.<\/p>\n\n

Mitigation<\/h2>\n\n

It is recommended to inventory self-managed GitLab CE\/EE instances and their versions. GitLab.com and GitLab Dedicated require no action. Upgrade to 19.5.4, 19.4.6, or 19.3.8, depending on the branch. If the instance is running 19.2 or earlier, within the range starting at 16.2, follow the vendor’s upgrade path to an already patched supported branch; there is no 19.2.x release in today’s batch.<\/p>\n\n

On user-compiled installations, rebuild the Git used by Gitaly and the Git referenced by the configuration, or update the distribution’s Git to 2.56.1 or the distribution’s patched version. If an immediate update is not possible, apply the temporary mitigation described in the CVE record (conflict-marker-size=7 in info\/attributes in each repository, or disable mergeability checks for untrusted repositories). This is not a substitute for the patch.<\/p>\n\n

The vendor did not publish indicators of compromise for this CVE. Do not reuse indicators from earlier advisories as if they applied to this flaw. The patch does not undo a previous compromise.<\/p>\n\n

GitLab security patches in recent weeks<\/h2>\n\n

This advisory does not replace the October ones: an instance may need to have applied those patches and also reach 19.5.4, 19.4.6, or 19.3.8. The table summarizes the confirmed security releases on the vendor’s patch pages from October to today.<\/p>\n\n

Date<\/strong><\/td>Versions<\/strong><\/td>What it covers<\/strong><\/td><\/tr>
Oct 2, 2026<\/strong><\/td>AI Gateway 19.4.1<\/td>CVE-2026-90970, command execution in AI Gateway. The vendor-hosted gateways were already fixed. This is not a GitLab CE\/EE patch.<\/td><\/tr>
Oct 12, 2026<\/strong><\/td>CE\/EE 19.4.2, 19.3.5, and 19.2.8<\/td>CVE-2026-97229, critical, CVSS 10.0, remote code execution in CI\/CD (Alert 2026-131). The batch includes other flaws.<\/td><\/tr>
Oct 21, 2026<\/strong><\/td>CE\/EE 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13<\/td>CVE-2026-110264, critical, CVSS 10.0, unauthenticated remote code execution (Alert 2026-118). The 12\/10 patches do not fix it.<\/td><\/tr>
Oct 29, 2026<\/strong><\/td>CE\/EE 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, and 18.11.14<\/td>CVE-2026-111943: stops trusting compromised intermediate certificates. Runner 19.5.1 must also be updated and, if used, the self-hosted AI Gateway. The advisory states that 19.5.2 and 19.4.4 do not exist.<\/td><\/tr>
Nov 10, 2026<\/strong><\/td>CE\/EE 19.5.4, 19.4.6, and 19.3.8<\/td>CVE-2026-105437 (this advisory). Versions 19.5.1 and 19.5.3 do not address it.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

The earlier GitLab alerts and the vendor’s patch advisories are listed below and under Additional information.<\/p>\n\n

Alert 2026-118 Critical GitLab vulnerability allows unauthenticated RCE<\/a><\/p>\n\n

Alert 2026-131 Critical GitLab vulnerability (CVE-2026-97229) allows RCE and is being actively exploited<\/a><\/p>\n\n

GitLab \u2014 patch 19.5.4 \/ 19.4.6 \/ 19.3.8 (Nov 10, 2026)<\/a><\/p>\n\n

GitLab \u2014 patch 19.5.3 \/ 19.4.5 \/ 19.3.7 (Oct 29, 2026)<\/a><\/p>\n\n

GitLab \u2014 patch 19.5.1 and related branches (Oct 21, 2026)<\/a><\/p>\n\n

GitLab \u2014 patch 19.4.2 \/ 19.3.5 \/ 19.2.8 (Oct 12, 2026)<\/a><\/p>\n\n

GitLab \u2014 AI Gateway 19.4.1 (Oct 2, 2026)<\/a><\/p>\n\n

Solution<\/h2>\n\n

The solution is to update self-managed GitLab CE\/EE instances to 19.5.4, 19.4.6, or 19.3.8 and, on user-compiled installations, also rebuild or update the Git used by Gitaly and the Git referenced by the configuration. GitLab.com and GitLab Dedicated require no action.<\/p>\n\n

For information on how to upgrade, visit the following link:<\/p>\n\n

https:\/\/docs.gitlab.com\/releases\/patches\/patch-release-gitlab-19-5-4-released\/<\/a><\/p>\n\n

Additional information:\u00a0<\/h2>\n\n