GitLab patches a critical flaw in its CI regex compiler

On October 12, 2026 GitLab shipped versions 19.4.2, 19.3.5, and 19.2.8 for Community Edition and Enterprise Edition. The release notes tell anyone running GitLab themselves to upgrade immediately. GitLab.com was already on the patched code, and Dedicated tenants were updated with an internal release before this note was published.

The issue GitLab marks critical is an integer overflow in the CI/CD regular-expression compiler. The same release also lists high-severity problems, including cross-site scripting in syntax highlighting and authorization bugs around pipelines. One regression is called out on its own: 19.3.4 broke merge request pages when the Ona integration was turned on, and 19.3.5 fixes that. Treat this as a security upgrade first. The notes pack many other fixes into the same versions, so read the advisory and plan the maintenance window instead of assuming it is a tiny patch.

Why it matters

Self-managed GitLab instances are exposed until they move to the patched releases.

Source: GitLab