GitLab 21-oktabrda o'z-o'zini boshqaradigan serverda tizimga kirmasdan kodni bajarishga imkon beradigan zaiflikni tuzatdi; bu zaiflik 2014-yilda chiqarilgan 7.0 versiyasidan boshlab dasturiy ta'minotning har bir versiyasiga ta'sir qiladi.
To'qqiz kun avval yangilagan ma'murlar uchun ham tuzatish muhim: 12-oktabrdagi yangilanish faqat 19.2 va undan keyingi versiyalarni qamrab olgan, yangi tuzatilgan versiyalar esa undan bir patch yuqorida joylashgan, shuning uchun o'sha paytda yangilangan nusxa yana zaiflik doirasiga kiradi.
CVE-2026-110264 deb kuzatiladigan bu zaiflik CVSS shkalasi bo'yicha 10.0 — maksimal baholangan. GitLab aytishicha, ma'lum sharoitlarda u autentifikatsiyasiz foydalanuvchiga serverda ixtiyoriy kodni bajarishga imkon beradi, chunki maxsus tayyorlangan muntazam ifoda kompilyatsiyasi paytida butun son to'lib ketishi (integer overflow) yuz beradi. GitLab bu sharoitlar nima ekanligini aytmagan.
Kompaniya zaiflik hujumlarda ishlatilganiga oid hech qanday belgi yo'qligini xabar qiladi va 22-oktabr holatiga ko'ra u AQSh CISA ma'lum ekspluatatsiya qilingan zaifliklar katalogida ro'yxatga olinmagan.
Faqat o'z-o'zini boshqaradigan o'rnatishlar chora ko'rishi kerak. GitLab.com allaqachon tuzatilgan versiyada ishlaydi, GitLab Dedicated ijarachilari esa 19.3.5-internal0 va 19.4.2-internal0 yoki undan keyingi ichki relizlarda allaqachon tuzatishga ega. GitLab zaiflikni bir vaqtda yetti versiyada tuzatdi.
Quyidagi jadval har bir reliz shoxasi bilan uni tuzatuvchi versiyani juftlashtiradi.
| Agar siz ishlatsangiz | Yangilang |
|---|---|
| 19.5 dan oldin 19.5.1 | 19.5.1 |
| 19.4 dan oldin 19.4.3 | 19.4.3 |
| 19.3 dan oldin 19.3.6 | 19.3.6 |
| 19.2 dan oldin 19.2.9 | 19.2.9 |
| 19.1 dan oldin 19.1.9 | 19.1.9 |
| 19.0 dan oldin 19.0.10 | 19.0.10 |
| 7.0 dan 18.11 gacha, 18.11.13 dan oldin | 18.11.13 |
Bu versiyalardan to'rttasi GitLab odatda yangilaydigan versiyalardan eskiroq. Kompaniyaning siyosati joriy reliz va oldingi ikki oylik relizni qamrab oladi, bugungi kunda bu 19.5, 19.4 va 19.3.
GitLab aytishicha, u bu tuzatishni 18.11.13, 19.0.10, 19.1.9 va 19.2.9 ga standart relizlar ustiga qo'shimcha ravishda orqaga ko'chirgan (backport), bu qadamni u faqat jiddiy muammolar uchun saqlaydi.
Zaiflikning shunchalik uzoq orqaga yetishining sababi — ishlamay qolgan GitLab qismi. Muntazam ifoda kompilyatori Ruby'ning o'rnatilgan dvigateli, Onigmo deb ataladi, GitLab uni o'z paketlari ichida jo'natadi va o'z qurilishlarida tuzatadi. Bu dvigateldagi zaiflik GitLab uni jo'natgan har joyda mavjud, ya'ni 7.0 dan boshlab har bir relizda.
GitLab shuningdek o'z-o'zini boshqaradigan ma'murlarga ekspluatatsiya urinishlarini aniqlashda yordam berish uchun ikkita aniqlash qoidasini e'lon qildi: "Onigmo native worker crash" va "Org mode render error burst". Ular kompaniyaning ochiq manbali TLDR ramkasining bir qismi bo'lib, har bir aniqlashni GitLab'ning o'z ilova jurnallariga qarshi Sigma formatida yozadi.
GitLab hujumchiga kompilyatorga yetish uchun qanday shartlar kerakligini aytmagan, shuning uchun ma'murlar konfiguratsiya orqali o'zlarini istisno qila olmaydi; tuzatish yagona ishonchli himoya, GitLab maslahati esa hech qanday vaqtinchalik yechim taklif qilmaydi.
Bu bir oy ichida GitLab'ning muntazam ifoda dvigatelida joaxcar taxallusidan foydalanadigan bir tadqiqotchi tomonidan xabar qilingan to'rtinchi kod bajarish zaifligi va 19.2 dan oldingi versiyalarga yetgan birinchisi.
12-oktabrda GitLab CVE-2026-97229 ni ham tuzatgan — bu ham autentifikatsiyasiz 10.0 balli regex kompilyatoridagi to'lib ketish, 19.2.8, 19.3.5 va 19.4.2 versiyalarida. 23-sentabrda u yana ikkitasini tuzatgan: CVE-2026-93577 va CVE-2026-89078, ikkalasi ham 9.9 ball, lekin tizimga kirgan hisob talab qiladi. Oldingi uchta zaiflik 19.2 versiyasida to'xtagan; bu esa to'xtamaydi.
21-oktabrdagi reliz jami 11 ta xavfsizlik muammosini tuzatadi, biri jiddiy, qolganlari yuqori, o'rta yoki past darajada.
Boshqalardan ikkitasi autentifikatsiyaga tegishli. CVE-2026-15723, yuqori 8.2 ball, tizimga kirgan foydalanuvchiga boshqa hisobni egallashga imkon berishi mumkin, lekin faqat ma'mur SAML va LDAP avtomatik bog'lanishini (auto-linking) bir vaqtda yoqqan bo'lsa.
GitLab'ning OAuth va OpenID Connect nuqtalaridagi kesh zaharlanishi (cache-poisoning) zaifligi, CVE-2026-112212, yuqori 7.5 ball, hujumchiga umumiy kesh ishlatiladigan sozlamalarda ma'lum kirish oqimlarini o'zi nazorat qiladigan serverga yo'naltirishga imkon berishi mumkin.
Yangilanish rejalashtirishga arziydigan xarajatga ega. 19.4.3 va 19.3.6 relizlari yangilanish paytida ishlaydigan ma'lumotlar bazasi o'zgarishlarini o'z ichiga oladi, va bitta tugunli serverda bu ular tugaguncha ishlamay qolish (downtime) degani. GitLab aytishicha, ko'p tugunli sozlamalar uning nol ishlamay qolish (zero-downtime) tartibi yordamida patchni ishlamay qolmasdan qo'llashi mumkin.
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014.
The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an instance updated then is in range again.
The flaw, tracked as CVE-2026-110264, is rated 10.0 on the CVSS scale, the maximum. GitLab says that, under certain conditions, it could allow an unauthenticated user to run arbitrary code on the server due to an integer overflow during the compilation of a specially crafted regular expression. GitLab has not said what those conditions are.
The company reports no sign the flaw has been used in attacks, and it is not listed in the U.S. CISA catalog of known exploited vulnerabilities as of October 22.
Only self-managed installations need to act. GitLab.com already runs the fixed version, and GitLab Dedicated tenants on the internal releases 19.3.5-internal0 and 19.4.2-internal0 or later already have the fix. GitLab fixed the flaw in seven versions at once.
The table below pairs each release branch with the version that fixes it.
| If you run | Upgrade to |
|---|---|
| 19.5 before 19.5.1 | 19.5.1 |
| 19.4 before 19.4.3 | 19.4.3 |
| 19.3 before 19.3.6 | 19.3.6 |
| 19.2 before 19.2.9 | 19.2.9 |
| 19.1 before 19.1.9 | 19.1.9 |
| 19.0 before 19.0.10 | 19.0.10 |
| 7.0 through 18.11, before 18.11.13 | 18.11.13 |
Four of those versions are older than GitLab normally patches. The company's policy covers the current release and the previous two monthly releases, which, as of today, are 19.5, 19.4, and 19.3.
GitLab said it backported this fix to 18.11.13, 19.0.10, 19.1.9, and 19.2.9 on top of its standard releases, a step it reserves for severe issues.
The reason the flaw reaches so far back is the part of GitLab that failed. The regular-expression compiler is Ruby's built-in engine, called Onigmo, which GitLab ships inside its own packages and patches in its own builds. A weakness in that engine is present wherever GitLab has shipped it, which is every release since 7.0.
GitLab also published two detection rules to help self-managed administrators look for exploitation attempts, named "Onigmo native worker crash" and "Org mode render error burst." They are part of the company's open-source TLDR framework, which writes each detection in the Sigma format against GitLab's own application logs.
GitLab has not said what preconditions an attacker needs to reach the compiler, so administrators cannot yet rule themselves out by configuration; the fix is the only certain protection, and GitLab's advisory offers no interim workaround.
This is the fourth code-execution flaw in GitLab's regular-expression engine that the same researcher, who uses the handle joaxcar, has reported in a month, and the first to reach versions before 19.2.
On October 12, GitLab fixed CVE-2026-97229, also an unauthenticated 10.0 overflow in the regex compiler, in versions 19.2.8, 19.3.5, and 19.4.2. On September 23, it fixed two more, CVE-2026-93577 and CVE-2026-89078, both rated 9.9 but requiring a logged-in account. The three earlier flaws stopped at version 19.2; this one does not.
The October 21 release fixes 11 security issues in all, one critical and the rest high, medium, or low.
Two of the others concern authentication. CVE-2026-15723, rated high at 8.2, could allow a logged-in user to take over another account, but only when an administrator has enabled both SAML and LDAP auto-linking.
A cache-poisoning flaw in GitLab's OAuth and OpenID Connect endpoints, CVE-2026-112212, rated high at 7.5, could allow an attacker to redirect certain sign-in flows to a server they control in setups that use a shared cache.
The upgrade carries a cost worth planning for. The 19.4.3 and 19.3.6 releases include database changes that run during the upgrade, and on a single-node server that means downtime while they finish. GitLab says multi-node setups can apply the patch without downtime using its zero-downtime procedure.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.