GitLab warns of critical security flaw

GitLab issued a security alert on Wednesday, October 21, urging companies that host GitLab on their own servers to update immediately. The vulnerability allows an attacker to run arbitrary commands on the server without needing an account, posing a serious risk to users.

Vulnerability affects all versions since 2014

The flaw is present in every version of GitLab since 7.0, which was released in 2014. PHP patches were released the same day at 4 p.m., following a leak that forced the project to warn users the day before.

GitLab is a key tool for software development

GitLab is a platform used by companies to store, compile, and deploy software code. Unlike GitHub, GitLab allows users to host the source code themselves. In its 2026 annual report, the company claims over 50 million registered users.

PHP vulnerability impacts online payments

The PHP vulnerabilities directly threaten payments on online stores. The GitLab vulnerability first puts the code of companies at risk, potentially exposing sensitive data and operations.

Vulnerability linked to Ruby’s Onigmo engine

The vulnerability, referenced as CVE-2026-110264, comes from Onigmo, the regular expression engine of the Ruby language. When Onigmo compiles a trapped expression, a number becomes too large and overflows the memory space allocated to it (an integer overflow).

GitLab rates the flaw as the most critical

GitLab rates the vulnerability 10 out of 10, the most critical level. It is essential to install the patch to protect against potential attacks. On October 12, GitLab had already fixed another vulnerability rated 10 in the same compiler (CVE-2026-97229), on versions 19.2 and later.

GitLab updates multiple versions for the first time

This vulnerability dates back to 2014, and GitLab had to change its usual patching habits. Usually, the publisher only patches the current version and the two previous ones. This time, it released patches for seven branches, up to 18.11.13, a measure reserved for serious issues.

Users must upgrade to specific versions

Users are advised to check the version of their GitLab instance, displayed on GitLab's Help page, and upgrade to the corrected version of their branch: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, or 18.11.13. If on 18.11, users must upgrade at least to 18.11.13, sometimes in several steps.

Other vulnerabilities fixed on October 21

On October 21, GitLab fixed twelve vulnerabilities in total. Among them, one allows taking control of an account when SAML and LDAP, which link GitLab to the company directory, are automatically linked (rated 8.2). Another could redirect some OAuth connections to a pirate server (rated 7.5).

Upgrades may require downtime

Users should also plan for a downtime, as versions 19.4.3 and 19.3.6 modify the database during the update, and on a single server, GitLab does not restart until the end of these modifications. If GitLab runs on multiple servers, users can apply the patch without interruption using the publisher's zero-downtime procedure.