GitLab yangi maksimal darajadagi kodni bajarish zaifligi haqida ogohlantirmoqda
Muallif: Sergiu Gatlan
2026-yil 22-oktabr
07:41
0
GitLab maksimal darajadagi Regular Expression Compiler (muntazam ifoda kompilyatori) zaifligi uchun xavfsizlik yangilanishlarini e'lon qildi. Bu zaiflik masofaviy hujumchilarga zaif serverlarda ixtiyoriy kodni bajarishga imkon beradi.
Bu xavfsizlik muammosi CVE-2026-110264 sifatida kuzatiladi va GitLab'ning HackerOne xato mukofot dasturi orqali "joaxcar" taxallusidan foydalanadigan xavfsizlik tadqiqotchisi tomonidan xabar qilingan.
CVE-2026-110264 GitLab'ning muntazam ifoda kompilyatoridagi butun son to'lib ketishi (integer overflow) zaifligidan kelib chiqadi. Bu fon dvigateli konfiguratsiya fayllaridagi muntazam ifodalarni tahlil qiladi va tekshiradi.
GitLab zaiflikni GitLab Community Edition (CE) va Enterprise Edition (EE) versiyalari 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 va 18.11.13 da tuzatdi va foydalanuvchilarga o'z nusxalarini darhol yangilashni tavsiya qildi.
"GitLab ma'lum sharoitlarda autentifikatsiyadan o'tmagan foydalanuvchiga maxsus tayyorlangan muntazam ifodani kompilyatsiya qilishda butun son to'lib ketishi tufayli GitLab serverida ixtiyoriy kodni bajarishga imkon berishi mumkin bo'lgan muammoni bartaraf etdi," deb aytdi kompaniya.
"Biz yuqorida tavsiflangan muammolardan ta'sirlangan barcha o'rnatishlar iloji boricha tezroq eng so'nggi versiyaga yangilanishini qat'iy tavsiya qilamiz. [..] GitLab.com allaqachon yangilangan versiyada ishlamoqda. 19.3.5-internal0 va 19.4.2-internal0 yoki undan keyingi versiyalarda ishlaydigan GitLab Dedicated ijarachilari allaqachon ushbu tuzatishlarni o'z ichiga oladi va hech qanday chora ko'rishi shart emas."
Internet tahdid kuzatuvchisi Shadowserver hozirda onlayn tarzda ochiq bo'lgan 2 700 dan ortiq GitLab Community Edition nusxalarini kuzatmoqda, ammo ularning qanchasi tuzoq (honeypot) ekanligi yoki allaqachon hujumlardan himoyalanganligi haqida hech qanday ma'lumot bermaydi.
Internetda ochiq bo'lgan GitLab CE nusxalari (Shadowserver)
GitLab o'n kun oldin mijozlarni CI/CD muntazam ifoda kompilyatoridagi yana bir muhim masofaviy kodni bajarish zaifligi (CVE-2026-97229) haqida ogohlantirgan edi. Bu zaiflik ham 10/10 CVSS asosiy balliga ega va xuddi shu xavfsizlik tadqiqotchisi tomonidan xabar qilingan.
O'tgan oyda u yana bir maksimal darajadagi GitLab CE/EE zaifligini (CVE-2026-85706) tuzatdi. Bu zaiflik autentifikatsiyadan o'tmagan hujumchilarga zaif serverlardan maxfiy ma'lumotlarni (masalan, hisob ma'lumotlari va boshqa sirlar) o'qish imkonini beradi.
Bir kun o'tib, AQSh Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA) CVE-2026-85706 ni faol foydalanilayotgan zaifliklar ro'yxatiga qo'shdi va federal agentliklarga tizimlarini uch kun ichida himoya qilishni buyurdi.
2021-yil noyabridan beri CISA beshta GitLab zaifligini yovvoyi tabiatda foydalanilgan deb belgilagan, jumladan, ransomware (tovon dasturi) hujumlarida foydalanilgan biri.
GitLab'ning DevSecOps platformasi dunyo bo'ylab 30 milliondan ortiq ro'yxatdan o'tgan foydalanuvchiga ega va Fortune 100 kompaniyalarining 50% dan ortig'i, jumladan Nvidia, T-Mobile, Lockheed Martin, Airbus va Goldman Sachs tomonidan foydalaniladi.
Hujumchilar haqiqiy hisob ma'lumotlariga ega bo'lgach, ularning harakatlarining faqat 37% i bloklanadi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy hisob ma'lumotlaridan foydalanayotganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnikadan texnikaga himoyani o'lchaydi.
Hisobotni oling
Tegishli maqolalar:
GitLab maksimal darajadagi kodni bajarish zaifligi haqida ogohlantirmoqda F5 muhim NGINX zaifliklari uchun banddan tashqari yangilanishlarni e'lon qildi Muqim BlockStrap zaifligi xakerlarga Magento serverlarida kodni bajarishga imkon beradi GitLab AI Gateway xizmatidagi muhim RCE zaifligi haqida ogohlantirmoqda CISA faol foydalanilayotgan Zimbra zaifligini shoshilinch tuzatishni buyurdi
GitLab warns of new max severity code execution vulnerability
By Sergiu Gatlan
October 22, 2026
07:41 AM
0
GitLab has released security patches for a maximum-severity Regular Expression Compiler flaw that can let remote attackers run arbitrary code on vulnerable servers.
This security issue is tracked as CVE-2026-110264 and was reported by a security researcher using the 'joaxcar' handle through GitLab's HackerOne bug bounty program.
CVE-2026-110264 stems from an integer overflow weakness in GitLab's Regular Expression Compiler, a background engine that parses and validates regular expressions in configuration files.
GitLab has fixed the vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13, and warned users to patch their instances immediately.
"GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression," the company said.
"We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible. [..] GitLab.com is already running the patched version. GitLab Dedicated tenants running 19.3.5-internal0 and 19.4.2-internal0 or later already include these fixes and do not need to take action."
Internet threat watchdog Shadowserver now tracks over 2,700 GitLab Community Edition instances exposed online, but it doesn't provide any information about how many of them are honeypots or have already been secured against attacks.
Internet-exposed GitLab CE instances (Shadowserver)
GitLab warned customers ten days ago about another critical remote code execution vulnerability (CVE-2026-97229) with a 10/10 CVSS base score in the CI/CD Regular Expression Compiler, reported by the same security researcher.
Last month, it fixed another maximum-severity GitLab CE/EE flaw (CVE-2026-85706) that lets unauthenticated attackers read sensitive data (e.g., credentials and other secrets) from vulnerable servers.
One day later, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-85706 to its list of actively exploited flaws and ordered federal agencies to secure their systems within three days.
Since November 2021, CISA has flagged five GitLab flaws used in the wild, including one exploited in ransomware attacks.
GitLab's DevSecOps platform has over 30 million registered users worldwide and is used by over 50% of Fortune 100 companies, including Nvidia, T-Mobile, Lockheed Martin, Airbus, and Goldman Sachs.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
Related Articles:
GitLab warns of max severity code execution vulnerability
F5 releases out-of-band patches for critical NGINX vulnerabilities
Critical BlockStrap flaw lets hackers run code on Magento servers
GitLab warns of critical RCE vulnerability in AI Gateway service
CISA orders urgent patching of actively exploited Zimbra flaw