Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 19.2 – < 19.2.7, 19.3 – < 19.3.3, 19.4 – < 19.4.1 | 19.2.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby3.3 | No fix yet | — |
| Debian 13 | ruby3.3 | 3.3.13-0+deb13u1 | — |
| Debian 12 | ruby3.1 | No fix yet | — |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | ruby +5 | 3.3.13-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | ruby4.0 +2 | 4.0.9-38.el10_2 | ALSA-2026:96233 |
| AlmaLinux 10 | ruby4.0-rubygem-mysql2 | 0.5.7-38.el10_2 | ALSA-2026:96233 |
| AlmaLinux 10 | ruby4.0-rubygem-pg | 1.6.3-38.el10_2 | ALSA-2026:96233 |
| AlmaLinux 10 | rubygem-bigdecimal | 3.1.5-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-bundler | 2.5.22-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-io-console | 0.7.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-irb | 1.13.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-json | 2.7.2-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-minitest | 5.20.0-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-power_assert | 2.0.3-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-psych | 5.1.2-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-racc | 1.7.3-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rake | 13.1.0-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rbs | 3.4.0-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rdoc | 6.6.3.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rexml | 3.4.4-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rss | 0.3.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-test-unit | 3.6.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-typeprof | 0.21.9-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygems +1 | 3.5.22-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 9 | ruby +4 | 3.0.7-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-bigdecimal | 3.0.0-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-bundler | 2.2.33-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-io-console | 0.5.7-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-irb | 1.3.5-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-json | 2.5.1-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-minitest | 5.14.2-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-mysql2 +1 | 0.5.5-3.module_el9.7.0+184+e2e36072 | ALSA-2026:96120, ALSA-2026:96068 |
| AlmaLinux 9 | rubygem-pg +1 | 1.5.4-2.module_el9.7.0+245+447713a2 | ALSA-2026:96120, ALSA-2026:96068 |
| AlmaLinux 9 | rubygem-power_assert | 1.2.1-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-psych | 3.3.2-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rake | 13.0.3-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rbs | 1.4.0-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rdoc | 6.3.4.1-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rexml | 3.2.5-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rss | 0.2.9-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-test-unit | 3.3.7-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-typeprof | 0.15.2-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygems +1 | 3.2.33-170.el9_8 | ALSA-2026:96067 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | ruby | 3.3.13-16.el10_2 | RLSA-2026:96235 |
| Rocky Linux 10 | ruby4.0 | 4.0.9-38.el10_2 | RLSA-2026:96233 |
| Rocky Linux 9 | ruby | 3.0.7-170.el9_8 | RLSA-2026:96067 |
| Rocky Linux 9 | rubygem-mysql2 | 0.5.5-3.module+el9.7.0+40032+36e56d0d | RLSA-2026:96120, RLSA-2026:96068 |
| Rocky Linux 9 | rubygem-pg | 1.5.4-2.module+el9.7.0+40188+314ad260.0.1 | RLSA-2026:96120, RLSA-2026:96068 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | ruby | 3.4.12-r0 | — |
| Alpine v3.23 | ruby | 3.4.12-r0 | — |
| Alpine v3.22 | ruby | 3.4.12-r0 | — |
| Alpine v3.21 | ruby | 3.3.13-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ruby3.4 +5 | 3.4.12-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-bigdecimal | 3.1.8-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-bundler | 2.6.9-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-io-console | 0.8.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-irb | 1.14.3-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-json | 2.9.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-minitest | 5.25.4-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-power_assert | 2.0.5-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-psych | 5.2.2-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-racc | 1.8.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rake | 13.2.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rbs | 3.8.0-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rdoc | 6.14.0-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rexml | 3.4.4-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rss | 0.3.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-test-unit | 3.6.7-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-typeprof | 0.30.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygems +1 | 3.6.9-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby4.0 +6 | 4.0.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-io-console | 0.8.2-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-irb | 1.16.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-json | 2.18.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-minitest | 6.0.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-power_assert | 3.0.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-psych | 5.3.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-racc | 1.8.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rake | 13.3.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rbs | 3.10.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rdoc | 7.0.3-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rexml | 3.4.4-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rss | 0.3.2-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-test-unit | 3.7.5-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-typeprof | 0.31.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygems +2 | 4.0.3-32.amzn2023.0.5 | ALAS2023-2026-3400 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | ruby +5 | 3.3.13-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | ruby4.0 +2 | 4.0.9-38.el10_2 | ELSA-2026-96233 |
| Oracle Linux 10 | ruby4.0-rubygem-mysql2 | 0.5.7-38.el10_2 | ELSA-2026-96233 |
| Oracle Linux 10 | ruby4.0-rubygem-pg | 1.6.3-38.el10_2 | ELSA-2026-96233 |
| Oracle Linux 10 | rubygem-bigdecimal | 3.1.5-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-bundler | 2.5.22-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-io-console | 0.7.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-irb | 1.13.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-json | 2.7.2-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-minitest | 5.20.0-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-power_assert | 2.0.3-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-psych | 5.1.2-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-racc | 1.7.3-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rake | 13.1.0-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rbs | 3.4.0-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rdoc | 6.6.3.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rexml | 3.4.4-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rss | 0.3.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-test-unit | 3.6.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-typeprof | 0.21.9-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygems +1 | 3.5.22-16.el10_2 | ELSA-2026-96235 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | gitlab-runner-19.2 +5 | 19.2.6-r1 | — |
Advisories 16
- RLSA-2026:96233 Moderate: ruby4.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96235 Moderate: ruby security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96067 Moderate: ruby security update Rocky Linux Security Advisories · Nov 10, 2026
- ALSA-2026:96235 Moderate: ruby security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 10, 2026
- WID-SEC-2026-3556 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- WID-SEC-2026-4416 Ruby: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Nov 9, 2026
- ALSA-2026:96120 Moderate: ruby:4.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 9, 2026
- ALSA-2026:96233 Moderate: ruby4.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 9, 2026
- ALSA-2026:96067 Moderate: ruby security update AlmaLinux Security Advisories · Nov 9, 2026
- ALSA-2026:96068 Moderate: ruby:3.3 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 9, 2026
- ALAS2023-2026-3400 Important: ruby4.0 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3413 Important: ruby3.4 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- RLSA-2026:96120 Moderate: ruby:4.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 9, 2026
- RLSA-2026:96068 Moderate: ruby:3.3 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 9, 2026
- ELSA-2026-96235 Moderate: ruby security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- ELSA-2026-96233 Moderate: ruby4.0 security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
References
- https://gitlab.com/gitlab-org/gitlab/-/work_items/629758
- HackerOne Bug Bounty Report #3995696 technical-description exploit permissions-required
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/