Advisories
GitLab 16.2.3 Patch: Fixes Artifacts Object Storage Geo Replication Bug
GitLab released 16.2.3 for CE and EE on Aug 3 2023 to correct a bug that impacted artifacts stored in object storage during geo‑replication. The update contains no new migrations and can be applied without downtime on multi‑node deployments. Defenders should apply the patch and consider disabling auto‑reconfigure if they prefer zero‑downtime upgrades.
What Happened
GitLab released version 16.2.3 to address a bug that caused artifacts stored in object storage to fail during geo‑replication.
Impact
The defect could result in missing or corrupted artifacts when replicated across geo sites. No database migrations are included, so the schema remains unchanged.
What to Do
- Upgrade all nodes to 16.2.3.
- Verify that the Omnibus package stops, runs migrations, and restarts automatically.
- If zero‑downtime upgrades are required, create /etc/gitlab/skip-auto-reconfigure before upgrading.
- Confirm that artifacts replicate correctly after the upgrade.
Upgrade Notes
Multi‑node deployments should not require any downtime. The update is safe for both Community and Enterprise Editions.
Related vulnerabilities
GitLab 16.9.8 Patch Release: Bug Fixes, No Security Updates
On May 9 2024 GitLab released 16.9.8 for Community and Enterprise Editions. The update addresses regressions and bugs but contains no security fixes. Defenders should apply the patch, review the auto‑reconfigure behavior, and use /etc/gitlab/skip‑auto‑reconfigure to avoid downtime in multi‑node setups.
Read briefing
Apple Unveils iPadOS 16.7.16 – Minor Update Focuses on Stability and Security
Apple rolled out iPadOS 16.7.16 (build 20H392) on May 11, 2026, delivering a handful of bug fixes, performance tweaks and critical security patches. The update addresses several reported crashes, improves memory management, and tightens sandboxing for third‑party apps. Users can install the patch via the Settings app or iTunes, and the update is fully compatible with all iPad models running iPadOS 16.7 and later.
Read briefing
Critical GitLab CE/EE Vulnerability (CVE-2026-97229) – Immediate Upgrade Required
An integer‑overflow flaw in GitLab’s CI/CD regex compiler (CVE‑2026‑97229) allows unauthenticated code execution on self‑managed instances. All GitLab Community and Enterprise Editions older than 19.4.2, 19.3.4, or 19.2.8 must be patched immediately, prioritizing internet‑facing deployments.
Read briefing
CISA Adds GitLab Path Traversal CVE‑2026‑85706 to KEV Catalog, Urges Rapid Patch
CISA has added CVE‑2026‑85706, a path‑traversal flaw in GitLab Community and Enterprise Editions, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The update reinforces BOD‑26‑04, which requires federal civilian agencies to prioritize remediation of high‑risk KEVs on exposed assets. All organizations should patch immediately and can submit other KEV candidates via CISA’s nomination form.
Read briefing