GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
GitLab issued critical security patches for multiple versions of its Community and Enterprise Editions to address high-severity vulnerabilities, urging immediate upgrades for self-managed instances.
GitLab released versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13 for both Community Edition and Enterprise Edition on October 21, 2026. These updates include critical bug fixes and security patches, with GitLab strongly advising all self-managed installations to upgrade immediately. GitLab.com and GitLab Dedicated tenants running recent internal versions already include these fixes and require no action.
The patches address multiple vulnerabilities, including an unauthenticated remote code execution flaw due to an integer overflow in regular expression compilation. Another issue allowed account takeover when OmniAuth SAML and LDAP auto-linking were enabled. Additional fixes prevent OAuth/OIDC cache poisoning and unauthorized access to sensitive data through improper authorization checks.
GitLab has also released threat detection updates for self-managed instances to help identify potential exploitation attempts. The company emphasizes maintaining security hygiene by upgrading to the latest patch release for supported versions. Customers are advised to review best practices for securing their GitLab instances as outlined in the company’s security blog.
Vulnerabilities range from high-severity remote code execution and account takeover risks to lower-severity information disclosure issues. GitLab notes that security fixes are typically disclosed publicly 90 days after release. The company reiterates its commitment to high security standards for all customer-facing and data-hosting components.