CVE-2026-89078: GitLab vulnerability

1. In CISA KEV: not seen
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not establishedNothing in the sources we check

DescriptionNVD

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Weakness

Double Free · Memory Corruption

Vendor

GitLab

Published

September 2026

Band

Unlikely (under 1%), September 2026

• Red Hat Enterprise Linux 10Fixed in ruby-3.3.13-16.el10_2 (RHSA-2026:96235)checked 12 Nov 15:00 UTC
• Red Hat Enterprise Linux 9Fixed in ruby-3.0.7-170.el9_8 (RHSA-2026:96067)checked 12 Nov 15:00 UTC
• Red Hat Enterprise Linux 8Affected, no fix releasedchecked 12 Nov 15:00 UTC
• Debian 13Fixed in ruby3.3 3.3.13-0+deb13u1 (DSA-6614-1)checked 12 Nov 15:00 UTC
• Debian 12Affected, no fix releasedchecked 12 Nov 15:00 UTC
• SUSE Linux Enterprise Server 16.1Affected, no fix releasedchecked 12 Nov 15:00 UTC
• SUSE Linux Enterprise Server 16.0Affected, no fix releasedchecked 12 Nov 15:00 UTC
• SUSE Linux Enterprise Server 15 SP7Affected, no fix releasedchecked 12 Nov 15:00 UTC
• openSUSE Leap 16.1Affected, no fix releasedchecked 12 Nov 15:00 UTC
• openSUSE Leap 16.0Affected, no fix releasedchecked 12 Nov 15:00 UTC
• Alpine Linux 3.24Fixed in ruby-3.4.12-r0checked 12 Nov 15:00 UTC
• Alpine Linux 3.23Fixed in ruby-3.4.12-r0checked 12 Nov 15:00 UTC
• Alpine Linux 3.22Fixed in ruby-3.4.12-r0checked 12 Nov 15:00 UTC

1. 12 Nov
   Seen in Debian’s tracker on 12 Nov: Debian 13 fixed in ruby3.3 3.3.13-0+deb13u1 (DSA-6614-1) Debian
2. 12 Nov
   SUSE’s tracker lists SLES 15 SP1 as not affected SUSE
3. 12 Nov
   SUSE’s tracker lists SLES 15 SP2 as not affected SUSE
4. 12 Nov
   SUSE’s tracker lists SLES 15 SP3 as not affected SUSE
5. 12 Nov
   SUSE’s tracker lists SLES 15 SP4 as not affected SUSE
6. 12 Nov
   SUSE’s tracker lists SLES 15 SP5 as not affected SUSE
7. 12 Nov
   SUSE’s tracker lists SLES 15 SP6 as not affected SUSE
8. 9 Nov
   Red Hat published RHSA-2026:96235 for RHEL 10 on 9 Nov (we saw it 12 Nov) Red Hat
9. 9 Nov
   Red Hat published RHSA-2026:96067 for RHEL 9 on 9 Nov (we saw it 12 Nov) Red Hat
10. 5 Nov
    Seen in Alpine’s tracker on 5 Nov: Alpine 3.21 fixed in ruby-3.3.13-r0 Alpine
11. 5 Nov
    Seen in Alpine’s tracker on 5 Nov: Alpine 3.22 fixed in ruby-3.4.12-r0 Alpine
12. 5 Nov
    Seen in Alpine’s tracker on 5 Nov: Alpine 3.23 fixed in ruby-3.4.12-r0 Alpine
13. 5 Nov
    Seen in Alpine’s tracker on 5 Nov: Alpine 3.24 fixed in ruby-3.4.12-r0 Alpine
14. 5 Nov
    Debian’s tracker lists Debian 12 as affected, with no fix released Debian
15. 5 Nov
    Debian’s tracker lists Debian 13 as affected, with no fix released Debian
16. 5 Nov
    Red Hat’s tracker lists RHEL 10 as affected, with no fix released Red Hat
17. 5 Nov
    Red Hat’s tracker lists RHEL 6 as affected, with no fix released Red Hat
18. 5 Nov
    Red Hat’s tracker lists RHEL 7 as affected, with no fix released Red Hat
19. 5 Nov
    Red Hat’s tracker lists RHEL 8 as affected, with no fix released Red Hat
20. 5 Nov
    Red Hat’s tracker lists RHEL 9 as affected, with no fix released Red Hat

Showing the latest 20 changes.

• NVD entrynvd.nist.gov
• Vendor advisorydocs.gitlab.com
• CVE recordcve.org
• Weakness CWE-415cwe.mitre.org