CVE-2026-89078
📛 CVE Title
Double Free in GitLab
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- GitLab
- CVSS severity
- CRITICAL
- CVSS score
- 9.9 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L- Effective score
- 9.9 / 10 CRITICAL source: CNA overview
- CWE(s)
-
CWE-415 - Reserved
- 2026-09-10
- Published
- 2026-09-23 23:05 UTC
- Last updated
- 2026-09-23 23:05 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/89xxx/CVE-2026-89078.json
- Linked Threat
- CVE-2026-89078 — Double Free in GitLab
NVD / KEV / EPSS data refreshed 2026-09-24 04:32 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-85736
EUVD enrichment is queued; refresh the page in a few seconds.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| GitLab | GitLab |
19.2 (affected),
19.3 (affected),
19.4 (affected)
|
— |
Vendor references (3)
References embedded in the original CVE record by the assigning CNA.
- https://gitlab.com/gitlab-org/gitlab/-/work_items/628577
- HackerOne Bug Bounty Report #4019059 technical-descriptionexploitpermissions-required
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:app.opencve.io
All GitLab Community Edition and Enterprise Edition installations are affected. Versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 are vulnerable; any release prior to those patch levels is impacted. The official fix is distributed in GitLab 19.2.7, 19.3.3 and 19.4.1 and later releases.
2026-09-24 11:10 UTC -
web:blog.qualys.com
Key Takeaways RedSun is a critical zero-day vulnerability in Microsoft Defender that allows low-privileged users to gain SYSTEM access No patch is currently available, leaving all Defender-enabled Windows systems potentially exposed Qualys VMDR detects affected assets instantly (QID 92382) TruRisk™ Eliminate enables immediate mitigation , removing exploitability without waiting for a fix ...
2026-09-24 11:10 UTC -
web:cybersecuritynews.com
Microsoft released its March 2026 Patch Tuesday security update on March 10, 2026 , addressing 78 vulnerabilities across a wide range of products, including Windows, Microsoft Office, Azure, SQL Server, and .NET.
2026-09-24 11:10 UTC -
web:senserva.com
Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.
2026-09-24 11:10 UTC -
web:thecybersecguru.com
Active exploitation of PaperCut NG/MF pre-auth RCE ( CVE - 2026 -81578, CVE - 2026 -82078). Full chain analysis, IOCs, detection & emergency patch guidance
2026-09-24 11:10 UTC -
web:threatprotect.qualys.com
PaperCut released an Urgent Security Advisory to address two actively exploited vulnerabilities, tracked as CVE - 2026 -82078 & CVE - 2026 -81578, impacting all versions of PaperCut NG and PaperCut MF.
2026-09-24 11:10 UTC -
web:watchtowr.com
Upgrade PaperCut NG/MF to the latest version and emergency patch , addressing CVE - 2026 -81578, CVE - 2026 -82078, and bypasses. Restart the PaperCut application service.
2026-09-24 11:10 UTC -
web:www.bleepingcomputer.com
Today is Microsoft's March 2026 Patch Tuesday with security updates for 79 flaws, including 2 publicly disclosed zero-day vulnerabilities.
2026-09-24 11:10 UTC -
web:www.cisecurity.org
<p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...
2026-09-24 11:10 UTC -
web:www.esentire.com
THE THREAT 2026 -09-02 Update: On September 1st, 2026 , PaperCut Software released Emergency Patch (Release 3) for customers with Internet-facing PaperCut NG/MF Application Servers that are unable to perform other mitigating actions. eSentire has observed incidents involving the…
2026-09-24 11:10 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-89078.json.
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "GitLab",
"repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
"vendor": "GitLab",
"versions": [
{
"lessThan": "19.2.7",
"status": "affected",
"version": "19.2",
"versionType": "semver"
},
{
"lessThan": "19.3.3",
"status": "affected",
"version": "19.3",
"versionType": "semver"
},
{
"lessThan": "19.4.1",
"status": "affected",
"version": "19.4",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program"
}
],
"descriptions": [
{
"lang": "en",
"value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-415",
"description": "CWE-415: Double Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T23:05:20.132Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/628577"
},
{
"name": "HackerOne Bug Bounty Report #4019059",
"tags": [
"technical-description",
"exploit",
"permissions-required"
],
"url": "https://hackerone.com/reports/4019059"
},
{
"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to versions 19.2.7, 19.3.3, 19.4.1 or above."
}
],
"title": "Double Free in GitLab"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-89078",
"datePublished": "2026-09-23T23:05:20.132Z",
"dateReserved": "2026-09-10T19:06:37.759Z",
"dateUpdated": "2026-09-23T23:05:20.132Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}