Do Son 
TL;DR
GitLab released versions 19.5.4, 19.4.6, and 19.3.8 on November 10, 2026, to fix a critical GitLab heap overflow. Tracked as CVE-2026-105437, the flaw sits in the bundled Git software and lets attackers run commands in Gitaly. Self-managed admins must update right away, while cloud hosts already run the fix.
- CVE: CVE-2026-105437
- CVSS: 7.5 (High · CVSSv3)
- Product: Git
- Affected: < 2.49.1, 2.50.0-rc0, 2.51.0-rc0, 2.52.0-rc0, 2.53.0-rc0, 2.54.0-rc0 (+2 more)
- Impact: Heap-based Buffer Overflow in Git
- Status: No confirmed exploitation yet
- Patched in: 2.49.1, 2.50.2, 2.51.3, 2.52.1 (+4 more)
- Action: Update to 2.49.1, 2.50.2, 2.51.3, 2.52.1 (+4 more) now
Why It Matters
GitLab runs source code repos and build pipelines for millions of coders worldwide. Because Gitaly handles every Git call on the host, a memory bug in this service puts source code at risk. Both the GitLab 19.5.4 patch release advisory and the Git 2.56.1 release notes confirm the high risk of this bug.
Researcher taise reported the flaw through the vendor’s HackerOne bug bounty program. Currently, neither source reports any active attacks in the wild or public exploit code for CVE-2026-105437. While exact server counts remain private, over 30 million users rely on GitLab globally.
How the Attack Works
Merge Buffer Calculation Overflow
First, the flaw stems from a size check overflow in Git’s merge code (CWE-122). Before writing merge output, Git calculates how much memory the result needs. However, that math can overflow during huge merges that mix many conflicts with a large conflict-marker-size setting.
Consequently, Git sets up a buffer that is too small and writes data past its end. As the vendor advisory states, “this vulnerability in git can result in out-of-bounds heap writes, which could be used to execute arbitrary commands within GitLab’s Gitaly environment.”
Affected Versions
This GitLab heap overflow hits all self-managed GitLab Community Edition (CE) and Enterprise Edition (EE) builds from 16.2 before 19.3.8. It also affects version 19.4 before 19.4.6 and version 19.5 before 19.5.4.
Patch and Mitigation Steps
As the vendor notes, “GitLab.com and GitLab Dedicated are already running a patched version.” Self-managed admins using official Linux packages or containers must update to 19.5.4, 19.4.6, or 19.3.8 right away. Meanwhile, teams with self-compiled hosts must rebuild the Git binaries inside Gitaly or update system Git to 2.56.1. If admins cannot patch now, they can set conflict-marker-size=7 in each repo’s info/attributes file. Taking these steps will keep your code safe.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
