Database/Control plane, storage & DevOps
GitLab CE/EE: integer overflow compiling a crafted CI/CD regular expression gives code execution on the server
Impact
A separate flaw from the double free in the same patch release: compiling a crafted regular expression from a CI/CD configuration overflows an integer and lets an authenticated user run code on the GitLab server, with scope marked as changed and availability fully impacted. The consequence for a GPU datacenter is the same as any CI-plane compromise - control of the images, charts and deployment credentials that reach GPU nodes, plus whatever cluster tokens the runners hold. It is listed separately because the mechanism and code path differ from CVE-2026-89078 even though the fixed versions coincide.
Who can reach it
Any authenticated GitLab user who can commit or edit a CI/CD configuration in a project they can write to. Remote, low privilege, no user interaction.
What to do
Upgrade to GitLab 19.2.7, 19.3.3 or 19.4.1 and restart the GitLab services - the same patch release that fixes CVE-2026-89078, so one maintenance window covers both. No node reboot needed; plan a brief CI outage and audit runner token use if the instance was broadly reachable.
References
Related entries
- lldpd (lldp_decode, management addresses): Buffer overflow in lldpd's LLDP decoder via large management addressesCVE-2015-8011 · lldpd (lldp_decode, management addresses)Critical
- Lantronix xPrintServer: The device ships with a hardcoded root account baked into every unit of a given firmware lineCVE-2016-4325 · Lantronix xPrintServerCritical
- HPE iLO3 / iLO4: Multiple unspecified flaws allowing remote information disclosure, data modification and DoSCVE-2016-4375 · HPE iLO3 / iLO4Critical
- Tridium Niagara AX (<=3.8) and Niagara 4 (<=4.4) framework: Log into the Niagara platform with a disabled account nameCVE-2017-16748 · Tridium Niagara AX (<=3.8) and Niagara 4 (<=4.4) frameworkCritical
- Lenovo / IBM Integrated Management Module 2 (IMM2) web administration service: The overflow is inside theCVE-2017-3774 · Lenovo / IBM Integrated Management Module 2 (IMM2) web administration serviceCritical
- Intel Active Management Technology / Standard Manageability: An authentication bypass in the AMT web interface: sendingCVE-2017-5689 · Intel Active Management Technology / Standard ManageabilityCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.