Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 19.2 – < 19.2.7, 19.3 – < 19.3.3, 19.4 – < 19.4.1 | 19.2.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby3.3 | No fix yet | — |
| Debian 13 | ruby3.3 | 3.3.13-0+deb13u1 | — |
| Debian 12 | ruby3.1 | No fix yet | — |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | ruby +5 | 3.3.13-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-bigdecimal | 3.1.5-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-bundler | 2.5.22-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-io-console | 0.7.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-irb | 1.13.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-json | 2.7.2-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-minitest | 5.20.0-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-power_assert | 2.0.3-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-psych | 5.1.2-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-racc | 1.7.3-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rake | 13.1.0-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rbs | 3.4.0-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rdoc | 6.6.3.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rexml | 3.4.4-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rss | 0.3.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-test-unit | 3.6.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-typeprof | 0.21.9-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygems +1 | 3.5.22-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 9 | ruby +4 | 3.0.7-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-bigdecimal | 3.0.0-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-bundler | 2.2.33-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-io-console | 0.5.7-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-irb | 1.3.5-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-json | 2.5.1-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-minitest | 5.14.2-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-mysql2 +1 | 0.5.5-3.module_el9.7.0+184+e2e36072 | ALSA-2026:96068 |
| AlmaLinux 9 | rubygem-pg +1 | 1.5.4-2.module_el9.7.0+245+447713a2 | ALSA-2026:96068 |
| AlmaLinux 9 | rubygem-power_assert | 1.2.1-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-psych | 3.3.2-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rake | 13.0.3-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rbs | 1.4.0-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rdoc | 6.3.4.1-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rexml | 3.2.5-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rss | 0.2.9-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-test-unit | 3.3.7-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-typeprof | 0.15.2-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygems +1 | 3.2.33-170.el9_8 | ALSA-2026:96067 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | ruby | 3.3.13-16.el10_2 | RLSA-2026:96235 |
| Rocky Linux 9 | ruby | 3.0.7-170.el9_8 | RLSA-2026:96067 |
| Rocky Linux 9 | rubygem-mysql2 | 0.5.5-3.module+el9.7.0+40032+36e56d0d | RLSA-2026:96068 |
| Rocky Linux 9 | rubygem-pg | 1.5.4-2.module+el9.7.0+40188+314ad260.0.1 | RLSA-2026:96068 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ruby4.0 | 4.0.9-1.1 | openSUSE-SU-2026:12252-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | ruby | 3.4.12-r0 | — |
| Alpine v3.23 | ruby | 3.4.12-r0 | — |
| Alpine v3.22 | ruby | 3.4.12-r0 | — |
| Alpine v3.21 | ruby | 3.3.13-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ruby3.4 +5 | 3.4.12-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-bigdecimal | 3.1.8-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-bundler | 2.6.9-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-io-console | 0.8.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-irb | 1.14.3-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-json | 2.9.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-minitest | 5.25.4-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-power_assert | 2.0.5-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-psych | 5.2.2-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-racc | 1.8.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rake | 13.2.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rbs | 3.8.0-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rdoc | 6.14.0-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rexml | 3.4.4-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rss | 0.3.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-test-unit | 3.6.7-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-typeprof | 0.30.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygems +1 | 3.6.9-27.amzn2023.0.8 | ALAS2023-2026-3413 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | ruby +5 | 3.3.13-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-bigdecimal | 3.1.5-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-bundler | 2.5.22-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-io-console | 0.7.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-irb | 1.13.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-json | 2.7.2-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-minitest | 5.20.0-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-power_assert | 2.0.3-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-psych | 5.1.2-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-racc | 1.7.3-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rake | 13.1.0-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rbs | 3.4.0-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rdoc | 6.6.3.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rexml | 3.4.4-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rss | 0.3.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-test-unit | 3.6.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-typeprof | 0.21.9-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygems +1 | 3.5.22-16.el10_2 | ELSA-2026-96235 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | gitlab-runner-19.2 +5 | 19.2.6-r1 | — |
Advisories 10
- RLSA-2026:96235 Moderate: ruby security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96067 Moderate: ruby security update Rocky Linux Security Advisories · Nov 10, 2026
- ALSA-2026:96235 Moderate: ruby security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 10, 2026
- WID-SEC-2026-3556 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- ALSA-2026:96067 Moderate: ruby security update AlmaLinux Security Advisories · Nov 9, 2026
- ALSA-2026:96068 Moderate: ruby:3.3 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 9, 2026
- ALAS2023-2026-3413 Important: ruby3.4 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- RLSA-2026:96068 Moderate: ruby:3.3 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 9, 2026
- ELSA-2026-96235 Moderate: ruby security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- openSUSE-SU-2026:12252-1 libruby4_0-4_0-4.0.9-1.1 on GA media SUSE / openSUSE Security Updates · Oct 24, 2026
References
- https://gitlab.com/gitlab-org/gitlab/-/work_items/628577
- HackerOne Bug Bounty Report #4019059 technical-description exploit permissions-required
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/