gitlab-rails-ce-fips-18.8

Direct Vulnerabilities

Known vulnerabilities in the gitlab-rails-ce-fips-18.8 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
L Incorrect Authorization	<18.8.11-r7
L GHSA-c3rm-3hqr-4qwm	<18.8.11-r7
L GHSA-vp7f-562j-4qgr	<18.8.11-r7
L Race Condition	<18.8.11-r7
L GHSA-6mxv-c89j-2494	<18.8.11-r7
L Allocation of Resources Without Limits or Throttling	<18.8.11-r7
L GHSA-9h8m-3fm2-qjrq	<18.8.11-r7
L Untrusted Search Path	<18.8.11-r7
L GHSA-86r3-q889-hvg2	<18.8.11-r4
L Incorrect Authorization	<18.8.11-r4
L GHSA-2rc9-8cx9-fxpr	<18.8.11-r4
L GHSA-g9g2-qc64-jgcj	<18.8.11-r4
L Missing Authorization	<18.8.11-r4
L Cross-site Scripting (XSS)	<18.8.11-r4
M Information Exposure	<18.8.11-r4
L GHSA-8jc8-cvqj-p926	<18.8.11-r4
L GHSA-35pc-qwv6-4858	<18.8.11-r4
L GHSA-94p8-87ff-w336	<18.8.11-r4
L Exposure of Sensitive Information Through Metadata	<18.8.11-r4
L GHSA-45h8-qrqh-xr5v	<18.8.11-r4
L GHSA-6fhj-cgmm-xfx6	<18.8.11-r4
L Missing Authorization	<18.8.11-r4
L Incorrect Authorization	<18.8.11-r4
L Improperly Controlled Modification of Dynamically-Determined Object Attributes	<18.8.11-r4
L Authorization Bypass Through User-Controlled Key	<18.8.11-r4
L GHSA-r82j-g6q9-mvx8	<18.8.11-r4
L CVE-2026-42505	<18.8.11-r3
L GHSA-ff52-ph69-cf7x	<18.8.11-r3
L CVE-2026-39822	<18.8.11-r3
L GHSA-xcgv-8mv7-v8c7	<18.8.11-r3
L Server-Side Request Forgery (SSRF)	<18.8.11-r1
L GHSA-pjwm-pj3p-43mv	<18.8.11-r1
L GHSA-rgh6-rfwx-v388	<18.8.11-r1
L GHSA-33vj-92qq-66hc	<18.8.11-r1
L Improper Input Validation	<18.8.11-r1
L CVE-2026-50195	<18.8.11-r1
L GHSA-cvxm-645q-p574	<18.8.11-r1
C Directory Traversal	<18.8.11-r1
L Symlink Following	<18.8.11-r1
L GHSA-84xv-jfrm-h4gm	<18.8.11-r1
L CVE-2026-42507	<18.8.11-r1
L CVE-2026-27145	<18.8.11-r1
L GHSA-h524-452v-82p9	<18.8.11-r1
L GHSA-4279-q6mj-392r	<18.8.11-r1
L CVE-2026-42504	<18.8.11-r1
L GHSA-h3gm-q7m7-mp28	<18.8.11-r1
L GHSA-jppx-rxg9-jmrx	<18.8.10-r1
L GHSA-9m57-25v3-79x9	<18.8.10-r1
L GHSA-89gr-r52h-f8rx	<18.8.10-r1
L GHSA-5cgq-3rg8-m6cv	<18.8.10-r1
L GHSA-q4h4-gmj2-qvw2	<18.8.10-r1
L GHSA-w879-237q-wc7r	<18.8.10-r1
L GHSA-rm3j-f69w-wqmq	<18.8.10-r1
L GHSA-x527-x647-q7gg	<18.8.10-r1
L GHSA-78mq-xcr3-xm33	<18.8.10-r1
L GHSA-qpw4-5x99-6vjp	<18.8.10-r1
L GHSA-vgwf-h737-ff37	<18.8.10-r1
L GHSA-45gg-vh54-h5m9	<18.8.10-r1
L GHSA-f5wc-c3c7-36mc	<18.8.10-r1
L GHSA-wrh2-89vg-4j9g	<18.8.10-r1
L Out-of-Bounds	<18.8.10-r1
L Integer Overflow or Wraparound	<18.8.10-r1
L GHSA-cg87-vwwh-xvgj	<18.8.10-r1
L Improper Certificate Validation	<18.8.10-r1
L GHSA-5cv4-jp36-h3mw	<18.8.10-r1
L Missing Authorization	<18.8.10-r1
L Incorrect Type Conversion or Cast	<18.8.10-r1
L Improper Verification of Cryptographic Signature	<18.8.10-r1
L CVE-2026-46598	<18.8.10-r1
L Improper Certificate Validation	<18.8.10-r1
L Improper Enforcement of Message Integrity During Transmission in a Communication Channel	<18.8.10-r1
L Improper Restriction of Rendered UI Layers or Frames	<18.8.10-r1
L CVE-2026-46595	<18.8.10-r1
L Resource Exhaustion	<18.8.10-r1
L Improper Restriction of Rendered UI Layers or Frames	<18.8.10-r1
L Improper Restriction of Rendered UI Layers or Frames	<18.8.10-r1
L GHSA-w9p8-pvxh-rxpj	<18.8.10-r1
L Missing Authorization	<18.8.10-r1
L GHSA-m9x8-m34x-fj9q	<18.8.10-r1
L Cross-site Scripting (XSS)	<18.8.10-r1
L Improper Certificate Validation	<18.8.10-r1
L Deserialization of Untrusted Data	<18.8.10-r1
L GHSA-h2jq-g4cq-5ppq	<18.8.10-r0
L Resource Exhaustion	<18.8.10-r0
L GHSA-q4qf-9j86-f5mh	<18.8.10-r0
H Resource Exhaustion	<18.8.10-r0
L GHSA-q2ww-5357-x388	<18.8.10-r0
M Improper Handling of Length Parameter Inconsistency	<18.8.10-r0
L GHSA-8vqr-qjwx-82mw	<18.8.10-r0
L Incorrect Behavior Order: Validate Before Canonicalize	<18.8.10-r0
L Partial Comparison	<18.8.10-r0
L GHSA-vgpv-f759-9wx3	<18.8.10-r0
H Permissive Regular Expression	<18.8.10-r0
L GHSA-7mqq-6cf9-v2qp	<18.8.10-r0
L GHSA-v569-hp3g-36wr	<18.8.10-r0
M Interpretation Conflict	<18.8.10-r0
L Permissive Regular Expression	<18.8.10-r0
L GHSA-qv7j-4883-hwh7	<18.8.10-r0
L GHSA-x8cg-fq8g-mxfx	<18.8.10-r0
H Resource Exhaustion	<18.8.10-r0
H Double Free	<18.8.9-r1
L CVE-2026-42499	<18.8.9-r1
M Out-of-bounds Write	<18.8.9-r1
L GHSA-qf3q-3h68-mmh2	<18.8.9-r1
L GHSA-2283-wf8c-rw8r	<18.8.9-r1
L GHSA-3v2c-x6q9-f697	<18.8.9-r1
L Open Redirect	<18.8.9-r1
L GHSA-xq5j-9r39-c3vf	<18.8.9-r1
H Partial Comparison	<18.8.9-r1
L GHSA-h74g-238j-357m	<18.8.9-r1
L Improper Encoding or Escaping of Output	<18.8.9-r1
L GHSA-qc64-m6c2-v4x7	<18.8.9-r1
H Allocation of Resources Without Limits or Throttling	<18.8.9-r1
L GHSA-7f3r-gwc9-2995	<18.8.9-r1
L GHSA-hg3h-g7xc-f7vp	<18.8.9-r1
L GHSA-5m4p-2gjx-p2g8	<18.8.9-r1
L GHSA-8g2r-hhvj-mv99	<18.8.9-r1
H NULL Pointer Dereference	<18.8.9-r1
L CVE-2026-39825	<18.8.9-r1
L CVE-2026-42501	<18.8.9-r1
L GHSA-497x-jcxf-m478	<18.8.9-r1
L GHSA-jp94-3292-c3xv	<18.8.9-r1
M Link Following	<18.8.9-r1
L Cross-site Scripting (XSS)	<18.8.9-r1
L Exposed Dangerous Method or Function	<18.8.9-r1
H Loop with Unreachable Exit Condition ('Infinite Loop')	<18.8.9-r1
L GHSA-p9h5-jm8x-mjm5	<18.8.9-r1
L GHSA-jrg3-gfjw-hm96	<18.8.9-r0
M Allocation of Resources Without Limits or Throttling	<18.8.9-r0
L GHSA-m4pr-4j3g-9v7v	<18.8.9-r0
L GHSA-jhf3-xxhw-2wpp	<18.8.9-r0
H Improper Certificate Validation	<18.8.9-r0
L GHSA-5w89-2c2x-6x66	<18.8.9-r0
L CVE-2026-32280	<18.8.9-r0
L Improper Validation of Array Index	<18.8.9-r0
H Allocation of Resources Without Limits or Throttling	<18.8.9-r0
L GHSA-gjvh-7jh8-7xhm	<18.8.9-r0
L GHSA-x4jj-h2v8-hqqv	<18.8.9-r0
L Integer Underflow	<18.8.9-r0
L GHSA-gm2x-2g9h-ccm8	<18.8.9-r0
H Incorrect Authorization	<18.8.9-r0
L Cross-site Scripting (XSS)	<18.8.7-r0
L Directory Traversal	<18.8.7-r0
L GHSA-whrj-4476-wvmp	<18.8.7-r0
L GHSA-mxw3-3hh2-x2mh	<18.8.7-r0
C CVE-2026-1229	<18.8.6-r2
L GHSA-q9hv-hpm4-hj6x	<18.8.6-r2
L Directory Traversal	<18.8.6-r0
L GHSA-j3gx-2473-5fp8	<18.8.6-r0
L Direct Request ('Forced Browsing')	<18.8.6-r0
L GHSA-rv83-g57w-fr8j	<18.8.6-r0
L GHSA-hm5p-x4rq-38w4	<18.8.8-r0
H Server-Side Request Forgery (SSRF)	<18.8.8-r0
M Improper Validation of Integrity Check Value	<18.8.4-r1
L GHSA-4vq8-7jfc-9cvp	<18.8.4-r1
L GHSA-37cx-329c-33x3	<18.8.4-r1
M Missing Initialization of Resource	<18.8.4-r1
M Cross-site Scripting (XSS)	<18.8.4-r0
C CVE-2025-68121	<18.8.4-r0
L GHSA-8jvr-vh7g-f8gx	<18.8.4-r0
L GHSA-cf2v-m456-7qjf	<18.8.4-r0
L GHSA-h355-32pf-p2xm	<18.8.4-r0
L CVE-2025-61732	<18.8.4-r0
L GHSA-8f2f-6w9m-mg42	<18.8.4-r0
L GHSA-w487-9r9p-6p96	<18.8.4-r0
L GHSA-95p8-ccjw-3g7f	<18.8.4-r0
H Allocation of Resources Without Limits or Throttling	<18.8.4-r0
L Improper Validation of Unsafe Equivalence in Input	<18.8.4-r0
M Cross-site Scripting (XSS)	<18.8.4-r0
L GHSA-m668-xfwp-34x6	<18.8.4-r0
H Allocation of Resources Without Limits or Throttling	<18.8.4-r0
L Incorrect Permission Assignment for Critical Resource	<18.8.3-r0
L GHSA-3966-f6p6-2qr9	<18.8.3-r0

Vulnerability

Vulnerable Version

Incorrect Authorization

<18.8.11-r7