GitLab published security updates on Wednesday for the Community Edition (CE) and Enterprise Edition (EE). The releases are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. They contain bug fixes and close 12 security vulnerabilities. The older branches 19.2.9, 19.1.9, 19.0.10 and 18.11.13 contain only the fix for the critical issue.

CVE-2026-110264 is rated CVSS 10.0. Under certain conditions, an unauthenticated attacker can use an integer overflow during compilation of specially crafted regular expressions to execute arbitrary code on the server. All GitLab versions from 7.0 onward are affected. No attacks have been reported so far.

The remaining 11 flaws are fixed only in 19.3.6, 19.4.3 and 19.5.1. CVE-2026-15723 has a CVSS score of 8.2 and lets an authenticated user take over other LDAP accounts without action by their owners when OmniAuth-SAML and LDAP-Auto-Linking are enabled together. CVE-2026-112212 has a CVSS score of 7.5. It allows unauthenticated attackers to alter an OAuth/OIDC discovery document in a shared cache and redirect certain OAuth flows to a server they control.

Five further issues have medium severity: CVE-2026-12664 with a CVSS score of 6.8, CVE-2026-16255 with 5.9, CVE-2026-105777 with 4.3, CVE-2026-13319 with 4.3 and CVE-2026-112378 with 4.3. Four issues are rated low: CVE-2026-105711, CVE-2026-14288, CVE-2026-112326 and CVE-2026-103515.

GitLab recommends that operators update all self-managed installations immediately. Fixing all 12 flaws requires an upgrade to 19.3.6, 19.4.3 or 19.5.1. GitLab.com already runs a patched version. GitLab-Dedicated instances are patched from 19.3.5-internal0 and 19.4.2-internal0. GitLab has published two detection rules for self-managed installations to identify attempts to exploit the critical vulnerability.