GitLab has released security updates fixing a heap overflow flaw in its bundled Git software that could let attackers run commands on self-managed servers.

The flaw, tracked as CVE-2026-105437, is fixed in GitLab versions 19.5.4, 19.4.6 and 19.3.8, released on 10 November. GitLab rates the flaw critical and strongly recommends that self-managed installations upgrade immediately. The NVD entry lists a CVSS score of 7.5.

How CVE-2026-105437 works

The bug sits in Git's merge code. Before writing merge output, Git calculates how much memory the result needs, but that calculation can overflow during very large merges that combine many conflicts with a large conflict-marker-size setting. Git then sets up a buffer that is too small and writes data past its end, corrupting heap memory.

As GitLab's advisory states, the flaw can result in out-of-bounds heap writes, which could be used to execute arbitrary commands within GitLab's Gitaly environment, the service that handles Git calls on a GitLab host. The flaw affects all self-managed GitLab Community and Enterprise Edition builds from version 16.2 before 19.3.8, version 19.4 before 19.4.6 and version 19.5 before 19.5.4.

What administrators should do

GitLab said its hosted services, GitLab.com and GitLab Dedicated, are already running a patched version. Self-managed administrators using official Linux packages or containers should update to 19.5.4, 19.4.6 or 19.3.8 straight away, while teams running self-compiled hosts should rebuild the Git binaries inside Gitaly or update system Git to version 2.56.1.

The flaw was reported by a researcher known as "taise" through GitLab's HackerOne bug bounty programme. Neither GitLab nor the reporting sources have reported active exploitation in the wild or public exploit code for CVE-2026-105437. Administrators who cannot patch immediately can set conflict-marker-size to 7 in each repository's info/attributes file as a temporary workaround.