GitLab Critical Patch Release: 19.5.4, 19.4.6, 19.3.8

On November 10, 2026, we released versions 19.5.4, 19.4.6, 19.3.8 for GitLab Community Edition and Enterprise Edition.

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com and GitLab Dedicated are already running a patched version. GitLab.com and GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Important guidance for self-compiled GitLab installations: The fix for CVE-2026-105437 is a patch to Git. Official GitLab Linux packages and container images already include the patched Git. For self-compiled installations, follow the Update Gitaly steps, which rebuild the Git binaries embedded in Gitaly. You must also rebuild the Git installation referenced by git.bin_path in config/gitlab.yml from the matching Gitaly stable branch, as described in Git. If that Git comes from your distribution’s package instead, upgrade it to 2.56.1 or later, or to a version your distribution has patched for CVE-2026-105437.

Security fixes

Table of security fixes

CVE-2026-105437 (vulnerability in git)

This release addresses the security issue CVE-2026-105437, a heap-based buffer overflow in git, by updating the version of git bundled with GitLab. This issue has been remediated on GitLab.com and GitLab Dedicated, and in GitLab CE/EE versions 19.3.8, 19.4.6, and 19.5.4.

In GitLab, under certain conditions, this vulnerability in git can result in out-of-bounds heap writes, which could be used to execute arbitrary commands within GitLab’s Gitaly environment.

Impacted Versions: GitLab CE/EE: all versions from 16.2 before 19.3.8, 19.4 before 19.4.6, and 19.5 before 19.5.4

Thanks taise for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

19.5.4

• [19.5] Update danger-review component to 2.2.0
• backup: Bump gocloud.dev to v0.47.0 for S3-compatible backup sink (19-5-stable backport)
• ci: Package on the omnibus branch matching the MR target (19-5-stable backport)
• ci: Use MR target branch directly for omnibus package trigger (19-5-stable)
• Backport of ‘Back off StoreScansWorker retries on lease contention’ to 19.5
• Backport of ‘Stop event purges from moving the stale scan cursor’ to 19.5
• Backport of ‘Fail closed when OpenBao login returns a non-JSON body’
• [19.5] Use the system CA bundle for gRPC default roots
• Restore the full coding environment for recommend_reviewers
• Backport of ‘Add 19.5 release note for GitLab Orbit GA’
• Backport of ‘Fail early when an API-only flow’s image has no curl’
• Backport of ‘Stop failing on stale browser console allowlist specs’ into 19.5
• Backport of ‘Read top-level dependency ancestors from direct graph edges’ into 19.5
• Backport of ‘Stop traversing full dependency graph on ingestion’ into 19.5
• Backport of “Fix use_legacy_view? for organization resource parent”
• Backport of ‘Drop stuck pages:deploy statuses when PagesWorker is exhausted’
• Backport of ‘Fence the affected package lookup with a LATERAL join’ to 19.5
• Backport of ‘Keep the relative URL root in streamed Rapid Diffs paths’

19.4.6

• [19.4] Update danger-review component to 2.2.0
• build: Build 19-4-stable on Go 1.26
• backup: Bump gocloud.dev to v0.47.0 for S3-compatible backup sink (19-4-stable backport)
• ci: Package on the omnibus branch matching the MR target (19-4-stable backport)
• ci: Use MR target branch directly for omnibus package trigger (19-4-stable)
• [19.4] Use the system CA bundle for gRPC default roots
• Backport of ‘Fix state leak from language ID constraint migration specs’ to 19.4
• Backport of ‘Batch vulnerability identifier upserts during ingestion’ to 19.4
• Backport of ‘Add concurrency limit to Security::Scans::PurgeByJobIdWorker’ to 19.4
• Backport of ‘Index SBOM occurrences for parent lookup in graph build’ into 19.4
• Backport of ‘Drop stuck pages:deploy statuses when PagesWorker is exhausted’
• Backport of ‘Fence the affected package lookup with a LATERAL join’ to 19.4
• Backport of ‘Keep the relative URL root in streamed Rapid Diffs paths’
• Backport of ‘Read top-level dependency ancestors from direct graph edges’ into 19.4
• Backport of ‘Stop traversing full dependency graph on ingestion’ into 19.4

19.3.8

• [19.3] Backport Ruby ISEQ and imemo_env Copy-on-Write GC fixes for 3.3
• [19.3] Update danger-review component to 2.2.0
• build: Build 19-3-stable on Go 1.26
• ci: Package on the omnibus branch matching the MR target (19-3-stable backport)
• ci: Use MR target branch directly for omnibus package trigger (19-3-stable)
• backup: Bump gocloud.dev to v0.47.0 for S3-compatible backup sink (19-3-stable backport)
• Backport of ‘Skip rewriting unchanged vulnerability identifiers’ to 19.3
• Backport of ‘Fix state leak from language ID constraint migration specs’ to 19.3
• [19.3] Use the system CA bundle for gRPC default roots
• Backport of ‘Skip conflicting inserts for finding identifiers’ to 19.3
• Backport of ‘Batch vulnerability identifier upserts during ingestion’ to 19.3
• Backport of the audit event fix from ‘Count CI job tokens sent as basic auth or bearer against the job user’ to 19.3
• Backport of ‘Remove unnecessary committer batch-load from mergeability fields’ to 19.3
• [19.3] Backport Ruby ISEQ and imemo_env Copy-on-Write GC fixes for 3.3

Important notes on upgrading

These versions do not include any new migrations, and for multi-node deployments, should not require any downtime.

Please be aware that by default the Omnibus packages will stop, run migrations, and start again, no matter how “big” or “small” the upgrade is. This behavior can be changed by adding a /etc/gitlab/skip-auto-reconfigure file, which is only used for upgrades.

Updating

To update, check out our update page.

GitLab subscriptions

Access to GitLab Premium and Ultimate features is granted by a paid subscription.

Alternatively, sign up for GitLab.com to use GitLab’s own infrastructure.