GitLab Issues Critical Patch for Heap-Based Buffer Overflow in Git

GitLab has issued critical patch releases for its Community Edition and Enterprise Edition, specifically versions 19.5.4, 19.4.6, and 19.3.8. These updates are essential for addressing CVE-2026-105437, a severe vulnerability identified within the Git software that GitLab utilizes. The company strongly advises all users with self-managed GitLab installations to upgrade to one of these patched versions immediately to mitigate potential security risks.

This critical vulnerability, CVE-2026-105437, is a heap-based buffer overflow within Git. Under specific exploitation conditions, this flaw could enable an attacker to execute arbitrary commands within GitLab's Gitaly environment. Gitaly is a GitLab component responsible for handling Git repository data, making its compromise a significant security concern. The fix involves updating the bundled Git version to a secure release.

GitLab.com and GitLab Dedicated environments have already been updated and are running a patched version, meaning customers using these managed services do not need to take any further action. For self-managed installations, the remediation strategy depends on how Git is managed. Official GitLab Linux packages and container images include the patched Git. However, for self-compiled installations, administrators must follow specific steps to update the Git binaries embedded within Gitaly. This includes rebuilding Gitaly and ensuring the Git installation referenced in config/gitlab.yml is also updated or patched.

If the Git installation for a self-compiled instance comes from the operating system's distribution package, users must upgrade it to version 2.56.1 or later, or to a version that their distribution has specifically patched for CVE-2026-105437. The vulnerability affects all GitLab CE/EE versions from 16.2 up to, but not including, the patched releases: 19.3.8, 19.4.6, and 19.5.4. The vulnerability was reported by "taise" through GitLab's HackerOne bug bounty program.

Beyond the critical security fix, these patch releases also include various bug fixes and component updates. For instance, version 19.5.4 includes updates to the danger-review component and backports for several features related to backup sinks, CI packaging, and worker retries. Similarly, 19.4.6 and 19.3.8 incorporate updates to the danger-review component and various backported fixes for build processes, CI triggers, and security-related workers.

GitLab emphasizes its commitment to maintaining high security standards across all its products and services. The company regularly releases patch versions, with scheduled releases occurring twice a month and ad-hoc critical patches for high-severity vulnerabilities. This proactive approach aims to ensure that customers can maintain good security hygiene by applying the latest fixes promptly.

Users are encouraged to consult GitLab's security releases documentation and the company's security FAQ for more detailed information on vulnerabilities and best practices for securing their GitLab instances. The prompt patching of such critical vulnerabilities underscores the importance of timely updates in safeguarding software development platforms.