By GitLab shipped a CVSS 10.0 emergency patch on October 12. An integer overflow in the CI/CD regex compiler lets an attacker run OS commands on any vulnerable self-managed server — no credentials required at exploit time. Rapid7 reproduced it in 24 hours, published proof-of-concept code on October 13, and Censys found 25,766 exposed hosts. The patch exists. Waiting is now a conscious choice to accept the risk.
Who needs to act
If you use GitLab.com or GitLab Dedicated, GitLab already patched your instance. Stop reading and go back to work.
If you run a self-managed CE or EE instance on any of these versions, you have a problem:
| Branch | Vulnerable range | Fixed version |
|---|---|---|
| 19.4 | 19.4.0 – 19.4.1 | 19.4.2 |
| 19.3 | 19.3.0 – 19.3.4 | 19.3.5 |
| 19.2 | 19.2.0 – 19.2.7 | 19.2.8 |
Older branches are not listed in the patch release — assume they are either not affected or end-of-life and already a larger problem.
How the attack works
The bug lives in Ruby’s Onigmo regex engine, which GitLab uses to compile CI/CD configuration rules. The attack is a two-stage bypass. First, the attacker crafts a regex that passes GitLab’s repeat scanner in US-ASCII — embedding an inline comment inside a quantifier to stay under the size limit. That same regex, when the CI linter later evaluates it against a UTF-8 repository path, causes Onigmo to recompile for the new encoding. During that recompilation, an integer overflow in the program-size calculation generates invalid bytecode. Shell access follows.
The entry point is GitLab’s public CI lint endpoint. An attacker needs a GitLab account on the instance to push the malicious branch first — but that is a low bar on most self-managed deployments that allow user registration or have public project creation enabled. The final exploit request requires no authentication at all. Rapid7’s full technical write-up steps through the complete exploit chain if you want to understand the bytecode corruption in detail.
Check your version, then upgrade
First, verify your current version:
sudo gitlab-rake gitlab:env:info | grep "GitLab version"If you are on an affected version, upgrade now.
Debian / Ubuntu:
sudo apt-get update
sudo apt-get install gitlab-ee=19.4.2-ee.0RHEL / CentOS:
sudo yum install gitlab-ee-19.4.2After the upgrade, confirm services came back up:
sudo gitlab-ctl statusThe upgrade includes database migrations. Single-node instances will experience brief downtime unless you follow GitLab’s official patch release notes and use the zero-downtime upgrade procedure. If your version is not directly upgradeable to 19.4.2, use the GitLab upgrade path tool to find intermediate stops.
If you genuinely cannot upgrade today
There is no patch-free fix. GitLab has not published a configuration toggle that disables the vulnerable code path. The interim options reduce the attack surface but do not remove it:
- Disable new user registration and restrict public project creation to admins only
- Place the GitLab instance behind a WAF configured to reject requests with anomalous regex patterns
- Remove or restrict internet-facing access to the CI lint API endpoint
These steps raise the bar for an attacker. They do not eliminate the vulnerability. Treat them as a bridge to patching, not a substitute.
Why the urgency is real
Maximum CVSS scores get issued liberally enough that they sometimes feel like background noise. This one is different. Rapid7 did not just file a disclosure — they published a working exploit on GitHub one day after the patch dropped. Censys simultaneously found nearly 26,000 hosts still running vulnerable versions. The flaw is not yet in CISA’s Known Exploited Vulnerabilities catalog, but a public PoC with that many accessible targets has a short runway before someone weaponizes it at scale.
There is also a supply chain angle worth noting. The attack vector is a .gitlab-ci.yml file — the same artifact that runs your deployment pipelines. A compromised GitLab server does not just lose source code. It loses CI/CD secrets, container registry credentials, and the ability to inject into build pipelines. The blast radius here is not a single server; it is everything that server touches. ByteIota covered last month’s GitLab CVSS 9.9 RCE — this one is worse, and the PoC is already public.
