CVE-2026-93577: GitLab vulnerability
Fixed in RHEL 9/10, Debian 13, Alpine 3.22/3.23/3.24 · Affected: GitLab · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 50% of scored CVEs
DescriptionNVD
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- GitLab
- Published
- September 2026
Fix status by distribution
From each distribution’s security tracker. Distributions we did not check are not listed.
- Red Hat Enterprise Linux 10Fixedchecked 12 Nov 15:00 UTC
- Red Hat Enterprise Linux 9Fixed in ruby-3.0.7-170.el9_8 (RHSA-2026:96067)checked 12 Nov 15:00 UTC
- Red Hat Enterprise Linux 8Affected, no fix releasedchecked 12 Nov 15:00 UTC
- Debian 13Fixed in ruby3.3 3.3.13-0+deb13u1 (DSA-6614-1)checked 12 Nov 15:00 UTC
- Debian 12Affected, no fix releasedchecked 12 Nov 15:00 UTC
- SUSE Linux Enterprise Server 16.1Affected, no fix releasedchecked 12 Nov 15:00 UTC
- SUSE Linux Enterprise Server 16.0Affected, no fix releasedchecked 12 Nov 15:00 UTC
- SUSE Linux Enterprise Server 15 SP7Affected, no fix releasedchecked 12 Nov 15:00 UTC
- openSUSE Leap 16.1Affected, no fix releasedchecked 12 Nov 15:00 UTC
- openSUSE Leap 16.0Affected, no fix releasedchecked 12 Nov 15:00 UTC
- Alpine Linux 3.24Fixed in ruby-3.4.12-r0checked 12 Nov 15:00 UTC
- Alpine Linux 3.23Fixed in ruby-3.4.12-r0checked 12 Nov 15:00 UTC
- Alpine Linux 3.22Fixed in ruby-3.4.12-r0checked 12 Nov 15:00 UTC
What changed
Alpine status tracked since 5 Nov 2026. Debian status tracked since 5 Nov 2026. Red Hat status tracked since 5 Nov 2026. SUSE status tracked since 5 Nov 2026.
- Seen in Debian’s tracker on 12 Nov: Debian 13 fixed in ruby3.3 3.3.13-0+deb13u1 (DSA-6614-1) Debian
- Seen in Red Hat’s tracker on 12 Nov: RHEL 10 fixed Red Hat
- SUSE’s tracker lists SLES 15 SP1 as not affected SUSE
- SUSE’s tracker lists SLES 15 SP2 as not affected SUSE
- SUSE’s tracker lists SLES 15 SP3 as not affected SUSE
- SUSE’s tracker lists SLES 15 SP4 as not affected SUSE
- SUSE’s tracker lists SLES 15 SP5 as not affected SUSE
- SUSE’s tracker lists SLES 15 SP6 as not affected SUSE
- Red Hat published RHSA-2026:96067 for RHEL 9 on 9 Nov (we saw it 12 Nov) Red Hat
- Seen in Alpine’s tracker on 5 Nov: Alpine 3.21 fixed in ruby-3.3.13-r0 Alpine
- Seen in Alpine’s tracker on 5 Nov: Alpine 3.22 fixed in ruby-3.4.12-r0 Alpine
- Seen in Alpine’s tracker on 5 Nov: Alpine 3.23 fixed in ruby-3.4.12-r0 Alpine
- Seen in Alpine’s tracker on 5 Nov: Alpine 3.24 fixed in ruby-3.4.12-r0 Alpine
- Debian’s tracker lists Debian 12 as affected, with no fix released Debian
- Debian’s tracker lists Debian 13 as affected, with no fix released Debian
- Red Hat’s tracker lists RHEL 10 as affected, with no fix released Red Hat
- Red Hat’s tracker lists RHEL 6 as affected, with no fix released Red Hat
- Red Hat’s tracker lists RHEL 7 as affected, with no fix released Red Hat
- Red Hat’s tracker lists RHEL 8 as affected, with no fix released Red Hat
- Red Hat’s tracker lists RHEL 9 as affected, with no fix released Red Hat
Showing the latest 20 changes.
Coverage2 articles · 1 outlet
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 24 Sep.
- Thu 24 Sep, 02:30 UTC. SecurityOnline, first report. GitLab Fixes Critical CI/CD Flaws Enabling Arbitrary Code Execution.
- Mon 26 Oct, 03:21 UTC. SecurityOnline. Ruby fixes regex flaws that could enable GitLab server attacks.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 24 Sep 02:30 | SecurityOnline | GitLab Fixes Critical CI/CD Flaws Enabling Arbitrary Code Execution |
| 26 Oct 03:21 | SecurityOnline | Ruby fixes regex flaws that could enable GitLab server attacks |
- Ruby fixes regex flaws that could enable GitLab server attacksSecurityOnline · mentions it in passing
- GitLab Fixes Critical CI/CD Flaws Enabling Arbitrary Code ExecutionSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.