CVE-2026-105437: GitLab Heap Overflow Fixed in 19.5.4
GitLab released versions 19.5.4, 19.4.6, and 19.3.8 on November 10, 2026, to fix a critical GitLab heap overflow. Tracked as CVE-2026-105437, the flaw sits in the bundled Git software and lets attackers run commands in Gitaly. Self-managed admins must update right away, while cloud hosts already run the fix.
Affected: < 2.49.1, 2.50.0-rc0, 2.51.0-rc0, 2.52.0-rc0, 2.53.0-rc0, 2.54.0-rc0 (+2 more)
Entenda a falha
A vulnerabilidade
CVE-2026-105437 is a heap-based buffer overflow (CWE-122) in the Git software bundled with GitLab. Under certain conditions it gives out-of-bounds heap writes, which GitLab says could be used to run arbitrary commands inside Gitaly's environment. The articles do not state whether authentication is needed. Affected are GitLab CE/EE from 16.2 before 19.3.8, 19.4 before 19.4.6 and 19.5 before 19.5.4. Fixes are in 19.3.8, 19.4.6 and 19.5.4, and in Git 2.49.1, 2.50.2, 2.51.3, 2.52.1 and later builds, including 2.56.1. GitLab.com and Dedicated are already patched. SecurityOnline gives CVSS 7.5 (High), although the story calls it critical.
Como funciona
Gitaly handles Git operations on the GitLab host and relies on the bundled Git. When Git performs a merge, it first calculates how much memory the merged output needs, then allocates a buffer of that size and writes the result into it. According to SecurityOnline, that size calculation can overflow in very large merges that combine many conflicts with a large conflict-marker-size setting. The buffer ends up smaller than the data written, and the write runs past its end on the heap.
Por que é vulnerável
The root cause is an integer overflow in the size calculation in Git's merge code, with no protection against it before the buffer is allocated. The result is an undersized heap buffer and an out-of-bounds write. The articles do not say why it went unnoticed. GitLab fixes it by updating the bundled Git. As a stopgap, SecurityOnline says admins can set conflict-marker-size=7 in each repository's info/attributes file.
Onde está
The flaw is in the merge code of Git, which GitLab bundles and runs through Gitaly. The articles do not name a file, function or commit.
Como foi descoberta
A researcher known as taise reported the flaw through GitLab's HackerOne bug bounty program. GitLab disclosed it in the 19.5.4, 19.4.6 and 19.3.8 patch release on November 10, 2026. SecurityOnline says no active exploitation was confirmed at the time. The articles do not say how taise found the bug.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 19:15.
Linha do tempo
-
GitLab Critical Patch Release: 19.5.4, 19.4.6, 19.3.8
ler a análise desta fonte ocultar
On November 10, 2026, we released versions 19.5.4, 19.4.6, 19.3.8 for GitLab Community Edition and Enterprise Edition.
These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com and GitLab Dedicated are already running a patched version. GitLab.com and GitLab Dedicated customers do not need to take action.
-
CVE-2026-105437: GitLab Heap Overflow Fixed in 19.5.4
ler a análise desta fonte ocultar
GitLab released versions 19.5.4, 19.4.6, and 19.3.8 on November 10, 2026, to fix a critical GitLab heap overflow. Tracked as CVE-2026-105437, the flaw sits in the bundled Git software and lets attackers run commands in Gitaly. Self-managed admins must update right away, while cloud hosts already run the fix.
Affected: < 2.49.1, 2.50.0-rc0, 2.51.0-rc0, 2.52.0-rc0, 2.53.0-rc0, 2.54.0-rc0 (+2 more)