GitLab releases security update fixing 24 vulnerabilities including one critical flaw

aerial photo of city — Jonathan Kim / Unsplash

GitLab released a security update for its software development platform on October 8, 2026, to address 24 identified vulnerabilities. The company urged users to apply the patches immediately because the release includes a fix for a critical security flaw.

The update applies to GitLab Community Edition and GitLab Enterprise Edition. The specific versions released to contain the fixes are 19.4.2, 19.3.4, and 19.2.8. The security bulletin lists one vulnerability rated as critical, five rated as high, 14 rated as medium, and four rated as low.

The critical vulnerability, identified as CVE-2026-97229, stems from an integer overflow in the processing of regular expressions within CI/CD configurations. Insufficient validation of these expressions allows an unauthenticated attacker to execute arbitrary code on the GitLab server under specific conditions. The Common Vulnerability Scoring System version 3.1 assigns this flaw a base score of 10.0, which is the maximum possible value.

Among the high severity issues, CVE-2026-92883 is a cross-site scripting vulnerability caused by syntax highlighting processing. Another high severity flaw, CVE-2026-16301, allows users with Developer permissions to bypass restrictions and execute CI/CD pipelines. Additionally, CVE-2026-14814 involves the contamination of repository file caches. The remaining high severity vulnerabilities are identified as CVE-2026-81839 and CVE-2026-96893.

The update also resolves 14 medium severity vulnerabilities and four low severity vulnerabilities. The medium severity identifiers include CVE-2026-5954, CVE-2026-6567, CVE-2026-7767, CVE-2026-14210, CVE-2026-14552, CVE-2026-16275, CVE-2026-78335, CVE-2026-84284, CVE-2026-85529, CVE-2026-92528, CVE-2026-100755, CVE-2026-101168, CVE-2026-104661, and CVE-2026-105458. The low severity identifiers are CVE-2026-9268, CVE-2026-82632, CVE-2026-100104, and CVE-2026-103549.