gitlab-runner-18.4

Direct Vulnerabilities

Known vulnerabilities in the gitlab-runner-18.4 package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
L CVE-2026-78660	*
L CVE-2026-78667	*
L CVE-2026-94439	*
L CVE-2026-97031	*
L CVE-2026-56866	*
L CVE-2026-78669	*
L CVE-2026-97032	*
L CVE-2026-56857	*
L CVE-2026-78659	*
L CVE-2026-94448	*
L CVE-2026-94440	*
L CVE-2026-78663	*
L CVE-2026-97030	*
L CVE-2026-56851	*
L Incorrect Authorization	*
L Information Exposure	*
L Improper Handling of Case Sensitivity	*
L Improper Validation of Array Index	*
L CVE-2026-56855	*
L CVE-2026-78662	*
L Resource Exhaustion	*
L Allocation of Resources Without Limits or Throttling	*
L CVE-2026-56854	*
L GHSA-w67g-5rqw-f597	*
L Race Condition	*
M Numeric Errors	*
L CVE-2026-56865	*
L CVE-2026-56864	*
L CVE-2026-56860	*
L CVE-2026-33818	*
L CVE-2026-56858	*
L CVE-2026-56859	*
L CVE-2026-56853	*
L CVE-2026-56862	*
L GHSA-259r-337f-4rfw	*
L CVE-2026-56852	*
L CVE-2026-46600	*
L GHSA-hrxh-6v49-42gf	*
L Cross-site Scripting (XSS)	*
L Missing Authorization	*
M Use of Incorrectly-Resolved Name or Reference	*
L GO-2026-5932	*
L CVE-2026-39822	*
L CVE-2026-42505	*
L Untrusted Search Path	*
L Uncontrolled Memory Allocation	*
H Untrusted Search Path	*
M Improper Neutralization	*
L Authorization Bypass Through User-Controlled Key	*
H Cross-site Scripting (XSS)	*
L Allocation of Resources Without Limits or Throttling	*
L Authorization Bypass Through User-Controlled Key	*
L Incorrect Authorization	*
L Improper Restriction of Rendered UI Layers or Frames	*
L CVE-2026-46595	*
L Improper Certificate Validation	*
L Incorrect Type Conversion or Cast	*
L Deserialization of Untrusted Data	*
L Improper Enforcement of Message Integrity During Transmission in a Communication Channel	*
L Use of a Broken or Risky Cryptographic Algorithm	*
L CVE-2026-42507	*
L Improper Restriction of Rendered UI Layers or Frames	*
M Use of a Broken or Risky Cryptographic Algorithm	*
L Integer Overflow or Wraparound	*
M Loop with Unreachable Exit Condition ('Infinite Loop')	<18.4.0-r2
L CVE-2026-39821	*
L Resource Exhaustion	*
L Improper Certificate Validation	*
L CVE-2026-27145	*
L Out-of-Bounds	*
L CVE-2026-42504	*
L CVE-2026-46598	*
M CVE-2025-47911	<18.4.0-r2
L Improper Certificate Validation	*
L Improper Restriction of Rendered UI Layers or Frames	*
L Improper Verification of Cryptographic Signature	*
L Cross-site Scripting (XSS)	*
L GO-2025-3408	*
L Reachable Assertion	<18.4.0-r2
L Missing Authorization	*
L CVE-2026-39824	*
L Missing Authorization	*
L Use of Incorrectly-Resolved Name or Reference	*
L Allocation of Resources Without Limits or Throttling	*
L Incorrect Authorization	*
H Symlink Following	*
L Uncontrolled Search Path Element	*
L Cross-site Scripting (XSS)	*
L Allocation of Resources Without Limits or Throttling	*
L Missing Authorization	*
L CVE-2026-42501	*
H Loop with Unreachable Exit Condition ('Infinite Loop')	*
M Out-of-bounds Write	*
H Allocation of Resources Without Limits or Throttling	*
H Double Free	*
H NULL Pointer Dereference	*
L Cross-site Scripting (XSS)	*
L CVE-2026-42499	*
L GHSA-pmwq-pjrm-6p5r	*
M Link Following	*
L CVE-2026-39825	*
L Improper Encoding or Escaping of Output	*
L Allocation of Resources Without Limits or Throttling	*
H Integer Overflow or Wraparound	*
H Access of Resource Using Incompatible Type ('Type Confusion')	*
C CVE-2026-27143	*
L Allocation of Resources Without Limits or Throttling	*
M Allocation of Resources Without Limits or Throttling	*
H Allocation of Resources Without Limits or Throttling	*
L CVE-2026-32280	*
M Cross-site Scripting (XSS)	*
H Incorrect Authorization	*
H Improper Certificate Validation	*
M Link Following	*
L GHSA-xmrv-pmrh-hhx2	*
L Uncaught Exception	*
H Improper Handling of Parameters	*
H Authentication Bypass	*
H Off-by-one Error	*
L Improper Authorization	*
L GHSA-6g7g-w4f8-9c9x	*
L Cross-site Scripting (XSS)	*
L Directory Traversal	*
L Direct Request ('Forced Browsing')	*
H CVE-2025-15558	*
H Allocation of Resources Without Limits or Throttling	*
M Cross-site Scripting (XSS)	*
L Missing Authorization	*
L Incorrect Authorization	*
L Allocation of Resources Without Limits or Throttling	*
H Allocation of Resources Without Limits or Throttling	*
L Loop with Unreachable Exit Condition ('Infinite Loop')	*
L CVE-2025-61732	<18.4.0-r9
C CVE-2025-68121	<18.4.0-r9
L CVE-2025-61731	<18.4.0-r5
L Allocation of Resources Without Limits or Throttling	<18.4.0-r5
L Allocation of Resources Without Limits or Throttling	<18.4.0-r5
L CVE-2025-61730	<18.4.0-r5
L Out-of-bounds Write	<18.4.0-r5
L Improper Certificate Validation	<18.4.0-r3
L Improper Certificate Validation	<18.4.0-r3
L CVE-2025-58181	<18.4.0-r2
L CVE-2025-47914	<18.4.0-r2
M Missing Initialization of Resource	*

Vulnerability

Vulnerable Version

CVE-2026-78660