GitLab critical patch release

	GitLab critical patch release(docs.gitlab.com)
	404 points by artooro 4 days ago \| 91 comments
	tl;dr: GitLab released critical patches (19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13) addressing 12 vulnerabilities, headlined by CVE-2026-110264, a CVSS 10.0 integer overflow in the regex compiler that allows unauthenticated remote code execution on affected servers (versions 7.0 through 19.5.1). Other notable fixes include a high-severity OmniAuth-to-LDAP authentication flaw enabling account takeover and OAuth/OIDC discovery endpoint cache poisoning. Self-managed instances should upgrade immediately; GitLab.com and Dedicated are already patched.
	HN Discussion: ~Article lacks detail; real root cause is in Ruby's regex engine, not GitLab itself ↑GitLab has a concerning pattern of recurring vulnerabilities, especially regex-related •Confusion about whether the bug belongs to GitLab or an underlying library ↑This is part of a broader catastrophic security news cycle possibly driven by AI-assisted discovery •Practical operational advice and reports of patching issues/upgrade warnings persisting