GitLab Is Having a Rough Month #gitlab #security #programming
Read the Portuguese translation →
Author: Better Stack · Watch on YouTube
Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.
Original language: English
Original video: GitLab Is Having a Rough Month #gitlab #security #programming · Channel: Better Stack · 01:02 · Watch on YouTube
Topics: Cybersecurity and software security, AI developer tools, Open source and software ecosystems
Summary
Section titled “Summary”GitLab issued a critical patch for a 10-out-of-10 security vulnerability affecting self-managed servers dating back to GitLab 7, released in 2014. An unauthenticated attacker could run code on a server with at least one public project, and there is no workaround besides upgrading. The flaw involved a crafted regex causing an integer overflow in the compiler, and GitLab fixed it by patching its bundled Ruby. This is GitLab’s third perfect-10 vulnerability in six weeks; no exploitation of this latest flaw has been reported, but roughly 82,000 GitLab servers are reachable from the internet.
Key points
Section titled “Key points”- GitLab released a critical patch for a vulnerability rated 10 out of 10.
- The flaw affects every self-managed GitLab version from version 7 onwards.
- An attacker did not need an account, but the server needed at least one public project.
- GitLab.com was already patched; self-managed installations must upgrade, as there is no workaround.
- A specially crafted regex could trigger an integer overflow during compilation and lead to code execution.
- The issue was linked to Onigmo, the regex engine built into Ruby; GitLab patched its bundled copy of Ruby.
- Nine days earlier, GitLab patched another 10-out-of-10 issue in its CI/CD regex compiler.
- GitLab had three perfect-10 vulnerabilities in six weeks this year, compared with four from 2019 through the end of 2025.
- There is no sign the latest vulnerability has been exploited, though around 82,000 GitLab servers are internet-accessible.
Chapters
Section titled “Chapters”| Start | Chapter | Summary |
|---|---|---|
| 00:00 | Critical GitLab vulnerability | A critical unauthenticated code-execution flaw affects self-managed GitLab servers and requires an upgrade. |
| 00:31 | The regex compiler bug | A crafted regex caused an integer overflow in the compiler, and GitLab fixed the issue in its bundled Ruby. |
| 01:02 | Urgent upgrade recommendation | Although there is no sign of exploitation, the video urges owners of internet-accessible GitLab servers to upgrade. |
Quotes
Section titled “Quotes”someone without an account could run their own code on your GitLab server. — 00:00
there is no workaround, you just have to upgrade. — 00:00
A specially crafted regex causes an integer overflow when it’s compiled — 00:31
There’s no sign that anyone has used this latest one yet — 01:02
Concepts and entities
Section titled “Concepts and entities”GitLab, CVE, Onigmo, Ruby, CI/CD, integer overflow
Full transcript (original language)
Section titled “Full transcript (original language)”00:00 Every self-managed GitLab server of the past 12 years had a perfect 10 out of 10 security bug, and it’s the second one this month. So, on Wednesday, GitLab put out a critical patch for CVE rated 10 out of 10, and it means that someone without an account could run their own code on your GitLab server. The only catch was the server needed at least one public project on it. It hit every self-managed version from GitLab 7 onwards, and 7 came out in June 2014. Gitlab.com is already patched. If you host your own, there is no workaround, you just have to upgrade. The bug itself
00:31 was in the regular compiler. A specially crafted regex causes an integer overflow when it’s compiled, and that leads to code execution. GitLab’s own notes point to Onigmo, which is the regex engine built into Ruby, and they fixed it by patching the copy of Ruby that GitLab ships. 9 days earlier, GitLab also patched another 10 in its CI/CD regex compiler, and perfect 10s used to be pretty rare for GitLab. From 2019 to the end of 2025, it had four. This year, it’s had three in 6 weeks, and the one from September was being exploited
01:02 within a day of the patch. There’s no sign that anyone has used this latest one yet, but there are around 82,000 GitLab servers reachable from the internet, so if one of them is yours, go ahead and upgrade it today. Subscribe for more AI and dev news every week.