GitLab ships another CVSS 10 regex fix, update to 19.5.1 now

GitLab ships another CVSS 10 regex fix, update to 19.5.1 now

21 October 2026: GitLab has released 19.5.1, 19.4.3, 19.3.6 and backports down to 18.11.13 to fix CVE-2026-110264, a critical flaw (CVSS 10.0) that under certain conditions lets an attacker who is not logged in run code on a self-managed GitLab server by getting it to compile a crafted regular expression. It is the second maximum-severity regex bug this month, after CVE-2026-97229 earlier this month, and servers patched for that one need this release too.

Fixed versions

• 19.5: 19.5.1
• 19.4: 19.4.3
• 19.3: 19.3.6
• 19.2, 19.1, 19.0 and 18.11: 19.2.9, 19.1.9, 19.0.10 and 18.11.13, which carry only the critical fix

GitLab.com already runs the fix. GitLab Dedicated tenants on 19.3.5-internal0, 19.4.2-internal0 or later are covered and need do nothing. Every self-managed version from 7.0 onwards is affected, which is why the critical fix alone was backported to four older lines.

Two High flaws in sign-in

The same release closes two High issues on the current lines (19.3, 19.4 and 19.5):

• CVE-2026-15723 (CVSS 8.2): where OmniAuth SAML and LDAP auto-linking are both switched on, a logged-in user could take over an existing LDAP-backed account without the owner doing anything. Affected from 10.1.
• CVE-2026-112212 (CVSS 7.5): an attacker with no login could poison a shared cache's copy of an OAuth or OIDC discovery document and send certain sign-in flows to an external server. Affected from 18.3.

Five Medium fixes follow, including a GraphQL field that let read_api tokens read work item email addresses beyond their scope and, on Enterprise Edition, an AI Gateway header trusted enough to reach paid AI features without a subscription. The other Medium fixes cover incomplete enforcement of the instance-wide SAML and LDAP membership lock, internal credentials exposed in internal response headers, and an authorisation bypass in the group milestones API. Four Low issues touch merge request titles, approval policy enforcement, security findings cleanup and the group Duo admin lock for Amazon Q.

Patching and looking back

The 19.4.3 and 19.3.6 releases include database migrations, so a single-node instance will be down until they finish; multi-node installations can follow GitLab's zero-downtime upgrade procedure. Because the critical flaw needs no login, the window between disclosure and patch is the one to watch: GitLab has published two detections for self-managed instances, "Onigmo native worker crash" and "Org mode render error burst". A burst of either before the upgrade is worth investigating. Our source code management software category lists 17 products.

Related on TrustList:

• GitLab AI Gateway flaw CVE-2026-90970 lets Duo Agent Platform users escape the sandbox and run commands: update self-hosted gateways
• GitHub fixes secret-scanning flaw that can reach code execution on GHES
• GitHub Enterprise Cloud with data residency refuses X25519-only TLS clients from 7 October 2026

Sources

• GitLab: GitLab Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13, 21 October 2026
• GitLab security releases feed, 21 October 2026