Awesome find by https://hackerone.com/joaxcar and it's a little bit frightening that this severe of a bug isn't the biggest security vulnerability of today

What a great week security wise!

Back in perl 5.8 and older, the regex engine worked by recusing at the level of C functions, and so you could trigger stack overflows by giving it large strings.

Is this similar?

I wonder why gitlab even has its own regex compiler. Or is this a vulnerability in an underlying library or programming language?

possible bug? or too soon to check? :)

after updating a pop-up still shows:

"You are currently on version 19.5.1! We strongly recommend upgrading your GitLab installation immediately."

while 19.5.1 should be the latest and fixed version

I am concerned for my self hosted servers, well only hope is tailscale should be entirely secure, and egress is filtered heavily... If that doesn't work my home lab is fucked.

Any suggestions folks, not even my terminally online self can handle all of these.

If you're patching a fleet, gitlab-rake gitlab:env:info gives you the exact version per node, faster than guessing from the omnibus package name.

[dead]

"CVSS 10.0" isn't in the headline here and a CVSS of 10 doesn't actually mean anything.