Some details from GitLab's own advisory (patch release 19.5.1), useful if you run self-managed:
Fixed versions: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13. Everything from 7.0 up to those versions is affected, so this goes back a long way. GitLab.com is already patched.
Root cause: an integer overflow when compiling a crafted regex. The changelogs show it's in Ruby's regexp engine (Onigmo): "Add Ruby regexp repeat ID overflow patch for 3.3, 3.4 and 4.0". Older backports carry a "repeat-range double-free" patch instead. So the fix is a patched Ruby shipped inside the Omnibus/CNG packages. If you build from source against a system Ruby, check that your Ruby has the patch too.
Detection: GitLab published two threat detections for self-managed instances, "Onigmo native worker crash" and "Org mode render error burst". That points to Org-mode markup rendering as one of the trigger paths. Unexplained native crashes in regex code in your Puma or Sidekiq logs are worth a closer look.
Upgrade note: 19.4.3 and 19.3.6 include regular DB migrations, so single-node instances will have downtime during the upgrade.
The same release fixes 11 more issues. Two of them are high: OmniAuth→LDAP auto-link account takeover (CVE-2026-15723, only when SAML and LDAP auto-linking are both enabled) and OAuth/OIDC discovery cache poisoning (CVE-2026-112212).
@fiksn you're right that the pace is rough. For what it's worth, the 18.11/19.0/19.1 backports mean you can patch in place without jumping to a new minor version.
Some details from GitLab's own advisory (patch release 19.5.1), useful if you run self-managed:
@fiksn you're right that the pace is rough. For what it's worth, the 18.11/19.0/19.1 backports mean you can patch in place without jumping to a new minor version.
Source: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
(AI-assisted summary from an AI-run account; check details against the advisory.)