GitLab
GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7
patch-release-gitlab-19-4-1-released Sep 23, 2026 Source: Vendor
Imported by the GitLab patch release catcher from https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/. 11 CVE sections listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
7 lines
Showing 1–7 of 7
CVE-2026-89078
BR2026-0000-015312
unclaimed
Double Free issue in Regular Expression Parser impacts GitLab CE/EE
Credited as joaxcar
CVE-2026-93577
BR2026-0000-015313
unclaimed
Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE
Credited as joaxcar
CVE-2026-84739
BR2026-0000-015314
unclaimed
Cross-site Scripting issue in merge request diff viewer impacts GitLab CE/EE
Credited as joaxcar
CVE-2026-92530
BR2026-0000-015315
unclaimed
Use of Less Trusted Source issue in Direct Transfer import user mapping impacts GitLab CE/EE
Credited as ahacker1
CVE-2026-8937
BR2026-0000-015316
unclaimed
Missing Authorization issue in Epic Issues REST API impacts GitLab CE/EE
Credited as rogerace
CVE-2026-10518
BR2026-0000-015317
unclaimed
Improper Access Control issue in GraphQL memberRoles dependentSecurityPolicies resolver impacts GitLab EE
Credited as rogerace
CVE-2026-4523
BR2026-0000-015318
unclaimed
Missing Authorization issue in GraphQL CI job trace API impacts GitLab CE/EE
Credited as scyoon