GitLab patches critical git heap overflow CVE-2026-105437 (RCE in Gitaly) in 19.5.4, 19.4.6 and 19.3.8
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 13/11/2026 00:02; os links antigos trazem para cá.
Fontes: cert.cyber.gouv.fr ↗ docs.gitlab.com ↗ securityonline.info ↗
GitLab released versions 19.5.4, 19.4.6 and 19.3.8 on November 10, 2026 to fix CVE-2026-105437, a heap-based buffer overflow in git (docs.gitlab.com). The flaw can lead to arbitrary command execution in GitLab's Gitaly environment (docs.gitlab.com, securityonline.info). CERT-FR (cert.cyber.gouv.fr) described it on November 12, 2026 as a critical remote code execution vulnerability in GitLab CE and EE and urged prompt patching. GitLab.com and GitLab Dedicated are already protected, so the urgency applies to self-managed instances (docs.gitlab.com, securityonline.info). No active exploitation has been reported (securityonline.info), and no source mentions public exploit code or attribution.
Entenda a falha
A vulnerabilidade
CVE-2026-105437 is a heap-based buffer overflow in Git, the version bundled with GitLab CE and EE, that can lead to out-of-bounds heap writes and arbitrary command execution inside GitLab's Gitaly environment. GitLab rates it critical, and CERT-FR describes it as remote code execution. SecurityOnline lists a CVSS of 7.5 (High). Affected self-managed versions run from 16.2 before 19.3.8, 19.4 before 19.4.6, and 19.5 before 19.5.4. The fixes are 19.3.8, 19.4.6 and 19.5.4. Self-compiled installs can instead upgrade distribution Git to 2.56.1 or later. GitLab.com and GitLab Dedicated are already patched. The articles do not say whether authentication is required.
Como funciona
Gitaly handles Git operations on the GitLab host, so Git code runs when a merge is processed. During a very large merge with many conflicts, Git works out how much memory the merge output needs before writing it. According to SecurityOnline, that size calculation can overflow when the merge combines many conflicts with a large conflict-marker-size setting. Git then allocates a buffer that is too small and writes past its end on the heap, which the vendor says can be used to run commands in Gitaly.
Por que é vulnerável
The root cause is a size check that overflows in Git's merge code (CWE-122). The memory needed for the merge output is computed with arithmetic that can wrap around on huge inputs, so the buffer comes out smaller than the data written into it. The fix is a patch to Git, delivered by updating the Git bundled with GitLab. The articles do not say why it went unnoticed.
Onde está
The articles place the flaw in the size calculation of Git's merge code, but name no file, function or commit.
Como foi descoberta
A researcher known as taise reported the flaw through GitLab's HackerOne bug bounty program. GitLab published the fixes on November 10, 2026, and CERT-FR issued an advisory on November 12, pointing to the vendor bulletin. No source reports exploitation in the wild. The articles do not say when it was reported.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 00:17.
Detalhes técnicos
- Root cause: a size check overflow during complex or large merges with numerous conflicts, causing out-of-bounds heap writes (docs.gitlab.com, securityonline.info).
- Impact: potential arbitrary command execution within Gitaly (docs.gitlab.com, securityonline.info). CERT-FR describes it more generally as remote code execution (cert.cyber.gouv.fr).
- Affected versions: all self-managed GitLab CE/EE before 19.3.8, 19.4 before 19.4.6, and 19.5 before 19.5.4 (docs.gitlab.com, cert.cyber.gouv.fr).
Remediação
- Upgrade self-managed instances to 19.5.4, 19.4.6 or 19.3.8, depending on the release line in use (docs.gitlab.com).
- No action is required for GitLab.com or GitLab Dedicated (docs.gitlab.com).
- No workaround is mentioned in the sources.
Linha do tempo
-
Critical Remote Code Execution Vulnerability in GitLab CE and EE Prior to 19.3.8, 19.4.6, and 19.5.4
ler a análise desta fonte ocultar
A remote code execution vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) affecting versions prior to 19.3.8, 19.4.6, and 19.5.4. This flaw allows attackers to execute arbitrary code remotely, posing significant risks to affected installations. GitLab published security bulletins on November 10, 2026, providing necessary patches to remediate the issue. Users of vulnerable GitLab versions are strongly advised to apply the updates promptly to mitigate potential exploitation. The vulnerability is tracked as CVE-2026-105437.
-
GitLab releases critical security patch for CVE-2026-105437 heap overflow in git
ler a análise desta fonte ocultar
On November 10, 2026, GitLab issued version 19.5.4 along with 19.4.6 and 19.3.8, addressing a heap-based buffer overflow vulnerability in git, identified as CVE-2026-105437. This flaw stems from a size check overflow during complex merges, which can result in out-of-bounds heap writes, potentially enabling arbitrary command execution within GitLab’s Gitaly environment. Self-managed users must upgrade promptly, while GitLab.com and GitLab Dedicated are already protected. The vulnerability affects all self-managed GitLab CE/EE versions prior to 19.3.8, 19.4 before 19.4.6, and 19.5 before 19.5.4.
-
GitLab heap overflow vulnerability CVE-2026-105437 patched in latest releases
ler a análise desta fonte ocultar
GitLab has released version 19.5.4, along with 19.4.6 and 19.3.8, to address a critical heap overflow vulnerability in Git (CVE-2026-105437). The flaw results from a size check overflow during large merges involving numerous conflicts, which can lead to out-of-bounds heap writes. Although no active exploitation is reported, the vulnerability poses a serious risk due to its potential for arbitrary command execution within GitLab's Gitaly environment. Administrators of self-managed instances must update immediately, while cloud users are already protected.