GitLab Patch Release and Security Update: 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, 18.11.14

We have released versions 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, 18.11.14 for GitLab Community Edition (CE) and Enterprise Edition (EE). We also released version 19.5.1 for GitLab Runner and released versions 18.11.8, 19.0.13, 19.1.9, 19.2.5, 19.3.3, 19.4.3, 19.5.3 for GitLab AI Gateway.

These versions address CVE-2026-111943, along with additional unrelated bug fixes. We strongly recommend that all self-managed GitLab installations be upgraded to one of these versions. If you use the self-hosted version of Runners or AI Gateway, you must also upgrade those components to the latest versions; guidance is included below. GitLab-hosted infrastructure has already been upgraded.

Security update

CVE-2026-111943 - GitLab has removed trust for compromised eMudhra Intermediate CA Certificates for GitLab CE/EE

For GitLab CE/EE, GitLab has removed trust for eight eMudhra intermediate CA certificates whose private keys have been compromised. This release removes trust for those certificates from the certificate stores GitLab ships. For background, see eMudhra’s public incident write-up.

Impacted Versions: GitLab CE/EE: all versions before 18.11.14, 19.0 before 19.0.11, 19.1 before 19.1.10, 19.2 before 19.2.10, 19.3 before 19.3.7, 19.4 before 19.4.5, and 19.5 before 19.5.3.

Action required: update Self-Hosted GitLab Runner to version 19.5.1

Upgrading GitLab does not update GitLab Runner. Runner verifies certificates on its own, so you must also update GitLab Runner to version 19.5.1, and rebuild any CI/CD job images that include their own ca-certificates package. To update, see the Updating the Runner page.

Action required: update Self-Hosted GitLab AI Gateway to versions 18.11.8, 19.0.13, 19.1.9, 19.2.5, 19.3.3, 19.4.3, 19.5.3

Upgrading GitLab does not update the GitLab AI Gateway. AI Gateway verifies certificates on its own, so you must also update AI Gateway to versions 18.11.8, 19.0.13, 19.1.9, 19.2.5, 19.3.3, 19.4.3, 19.5.3 or above. To update, see the AI gateway installation page.

GitLab Community Edition and Enterprise Edition

19.5.3

• [Backport 19.5] Distrust compromised eMudhra CA certificates
• Bump Go to 1.27.3
• [19.5] Backport Ruby ISEQ and imemo_env Copy-on-Write GC fixes for 3.3
• Backport of ‘Stop jobs without a fetch from borrowing the Git object pool’ and ‘Fix downstream pipelines Git alternates’
• Backport of ‘Geo container registry replication missing manifest’ to 19.5
• Backport of ‘Make Rspack output independent of the checkout path’ into 19.5
• Backport of ‘Render only first note when replying to a discussion’ to 19-5
• Backport of ‘Support denylist filters for instance audit event streaming’ to 19.5
• Backport of ‘Build nested Jira request URLs from the configured API URL’
• Backport of ‘Index SBOM occurrences for parent lookup in graph build’ into 19.5
• Backport of ‘Add concurrency limit to Security::Scans::PurgeByJobIdWorker’ to 19.5
• Backport of “Create Geo job artifact verification state after the file is stored”
• [19.5] Revert the Orbit feature backports
• Bump cacerts to 2026-10-20
• Bump gitlab-omnibus-builder version to 5.69.1
• Backport: Allow skipping the redundant Pulp CLI publish after RPM uploads
• Backport: Do not print the Pulp CLI result after RPM uploads
• [19.5] Backport Ruby ISEQ and imemo_env Copy-on-Write GC fixes for 3.3
• [19-5] Go 1.27.3

19.4.5

• [Backport 19.4] Distrust compromised eMudhra CA certificates
• Bump Go to 1.26.10
• [19.4] Backport Ruby ISEQ and imemo_env Copy-on-Write GC fixes for 3.3
• Backport of ‘Coalesce concurrent security report ingestion per project’ to 19.4
• Backport of ‘Render only first note when replying to a discussion’ to 19-4
• Backport of ‘Build nested Jira request URLs from the configured API URL’
• Backport of ‘Skip conflicting inserts for finding identifiers’ 19.4
• Backport of ‘Support denylist filters for instance audit event streaming’ to 19.4
• Backport of the audit event fix from ‘Count CI job tokens sent as basic auth or bearer against the job user’
• Backport of “Create Geo job artifact verification state after the file is stored”
• [19.4] Revert the Orbit feature backports
• Backport of ‘Skip rewriting unchanged vulnerability identifiers’ to 19.4
• Backport: Bump timeout of Pulp upload jobs to 2 hours
• Bump cacerts to 2026-10-20
• Bump gitlab-omnibus-builder version to 5.68.1
• Backport: Allow skipping the redundant Pulp CLI publish after RPM uploads
• Backport: Do not print the Pulp CLI result after RPM uploads
• [19.4] Bump BUILDER_IMAGE_REVISION to 5.68.2
• [19.4] Backport Ruby ISEQ and imemo_env Copy-on-Write GC fixes for 3.3
• [19-4] Go 1.27.3

19.3.7

• [Backport 19.3] Distrust compromised eMudhra CA certificates
• Bump Go to 1.26.10
• [19.3-stable] Force GOFIPS140=off for the golang-fips toolchain
• Backport of ‘Coalesce concurrent security report ingestion per project’ to 19.3
• Backport of ‘Render only first note when replying to a discussion’ to 19-3
• Backport of ‘Build nested Jira request URLs from the configured API URL’
• Backport of “Create Geo job artifact verification state after the file is stored”
• Pin internal events validation component to v1.1.3 on 19-3-stable-ee
• Bump cacerts to 2026-10-20
• Bump gitlab-omnibus-builder version to 5.65.3
• Backport: Bump timeout of Pulp upload jobs to 2 hours
• Backport: Allow skipping the redundant Pulp CLI publish after RPM uploads
• Backport: Do not print the Pulp CLI result after RPM uploads
• [19.3] Bump BUILDER_IMAGE_REVISION to 5.65.4
• [19-3] Go 1.26.10

19.2.10

• Backport Go 1.26.10 and eMudhra CA distrust to 19.2-stable
• Backport of “Adjustments to Wiki experience” to 19.2
• [19.2] Use the system CA bundle for gRPC default roots
• Backport: Bump timeout of Pulp upload jobs to 2 hours
• [19.2] Bump cacerts to 2026-10-20
• [19.2] Bump BUILDER_IMAGE_REVISION to 5.63.4
• [19-2] Go 1.26.10

19.1.10

• Backport Go 1.26.10 and eMudhra CA distrust to 19.1-stable
• [19.1] Use the system CA bundle for gRPC default roots
• Backport: Bump timeout of Pulp upload jobs to 2 hours
• [19.1] Bump BUILDER_IMAGE_REVISION to 5.60.6
• [19.1] Bump cacerts to 2026-10-20
• [19-1] Go 1.26.10

19.0.11

• Backport Go 1.26.10 and eMudhra CA distrust to 19.0-stable
• [19.0] Use the system CA bundle for gRPC default roots
• Backport: Bump timeout of Pulp upload jobs to 2 hours
• [19.0] Bump cacerts to 2026-10-20
• [19.0] Bump BUILDER_IMAGE_REVISION to 5.60.6
• [19-0] Go 1.26.10

18.11.14

• Backport Go 1.26.10 and eMudhra CA distrust to 18.11-stable
• [18.11] Update gitlab-markup to 2.2.0 and rdoc to 8.1.0
• Backport: Bump timeout of Pulp upload jobs to 2 hours
• [18.11] Bump BUILDER_IMAGE_REVISION to 5.52.2
• [18.11] Bump cacerts to 2026-10-20
• [18-11] Go 1.26.10

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Regular migrations

The following versions include regular migrations that run during the upgrade process:

• 19.5.3
• 19.4.5

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update, check out our update page.

GitLab subscriptions

Access to GitLab Premium and Ultimate features is granted by a paid subscription.

Alternatively, sign up for GitLab.com to use GitLab’s own infrastructure.