GitLab patches critical regex integer overflow flaw
Original: GitLab critical patch release
Why This Matters
Critical regex flaw affects all self-managed GitLab installs across multiple versions.
GitLab released seven patch versions on Oct 21, 2026, fixing a critical integer overflow in its regex compiler plus eight additional security flaws across CE and EE. All self-managed instances should upgrade immediately.
GitLab shipped emergency patches across seven versions — 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 — on October 21, 2026, covering both Community Edition and Enterprise Edition. The most severe fix addresses a critical integer overflow in GitLab's regular expression compiler, a class of bug that can enable arbitrary code execution or denial-of-service if exploited. Two high-severity issues were also patched: an improper authentication flaw in OmniAuth-to-LDAP auto-linking email lookup, and a cache poisoning vulnerability in OAuth/OIDC discovery endpoints. Medium-severity fixes cover GraphQL work item email field access control, incomplete SAML/LDAP membership lock enforcement (EE only), internal credential exposure via response headers, and a group milestones API authorization bypass. Two low-severity issues round out the release. GitLab.com is already running the patched version. Dedicated tenants on 19.3.5-internal0 and 19.4.2-internal0 or later are also covered. Vulnerability details will be made public on GitLab's issue tracker 90 days after the patch date.