GitLab Product Security Update Advisory
Overview
Security updates addressing vulnerabilities in GitLab products have been released. These updates apply to GitLab CE/EE, and the affected CVEs vary depending on the version in use.
Resolved Vulnerabilities
- CVE-2026-89078: A double-free vulnerability in the regular expression parser (the component that processes regular expressions) of GitLab CE/EE.
- CVE-2026-93577: An integer overflow vulnerability in the regular expression compiler (the component that converts regular expressions into an executable form) of GitLab CE/EE.
- CVE-2026-110264: An integer overflow vulnerability in the regular expression compiler (the component that converts regular expressions into an executable form) of GitLab CE/EE.
- CVE-2026-112212: A cache poisoning vulnerability in the OAuth/OIDC search endpoint of GitLab CE/EE.
- CVE-2026-15723: An improper authentication vulnerability in the OmniAuth-LDAP automatic connection email lookup feature of GitLab CE/EE.
Affected Versions
- CVE-2026-89078, CVE-2026-93577: 19.2 Through 19.2.7, 19.3 Through 19.3.3, And 19.4 Through 19.4.1.
- CVE-2026-110264: 7.0 Or later but earlier than 18.11.13, 19.0 Or later but earlier than 19.0.10, 19.1 Or later but earlier than 19.1.9, 19.2 Or higher but less than 19.2.9, 19.3 Or higher but less than 19.3.6, 19.4 Or higher but less than 19.4.3, And 19.5 Or higher but less than 19.5.1.
- CVE-2026-112212, CVE-2026-15723: 18.3 Or higher but less than 19.3.6, 19.4 Or higher but less than 19.4.3, And 19.5 Or higher but less than 19.5.1.
Patch Versions
- The patch versions for CVE-2026-89078 and CVE-2026-93577 are 19.2.7, 19.3.3, And 19.4.1.
- The patch versions for CVE-2026-110264 are 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, And 19.5.1.
- The patch versions for CVE-2026-112212, CVE-2026-15723 are 19.3.6, 19.4.3, And 19.5.1.
Recommendations
Users are advised to update to the latest version of the Vulnerability Patch addressing these vulnerabilities.
