GitLab fixes heap overflow that could enable command execution

GitLab has released fixes for a critical heap overflow in the bundled Git software, tracked as CVE-2026-105437. On 10 November 2026, GitLab issued patch releases 19.5.4, 19.4.6 and 19.3.8 to address the flaw. The vulnerability, a memory bug in Gitaly (the service that handles Git calls on the host), could allow an attacker to execute arbitrary commands within GitLab’s Gitaly environment. The CVSS score is 7.5 (High, CVSSv3). At the time of the advisory, there were no confirmed in-the-wild exploits reported.

The issue stems from a merge buffer calculation overflow in Git’s merge code (CWE-122). During large merges with many conflicts and a sizeable conflict-marker-size setting, memory calculation can overflow, leading to an out-of-bounds write and a too-small buffer. According to the vendor advisory, this could enable arbitrary command execution within GitLab’s Gitaly environment.

The vulnerability affected self-managed GitLab CE/EE builds prior to 19.3.8, plus certain 19.4 and 19.5 releases, with patched versions noted as 19.5.4, 19.4.6, 19.3.8. GitLab[.]com and GitLab Dedicated are reported as already running patched deployments. Administrators using official packages or containers should upgrade; those with self-compiled hosts may need to rebuild Git binaries inside Gitaly or update Git to 2.56.1. If immediate patching is not possible, setting conflict-marker-size=7 in each repo’s info/attributes file is suggested.