CriticalFix available
gitlab-rails-ce-fips-18.10 — security advisory
This notice tracks CVE-2026-39821 for gitlab-rails-ce-fips-18.10. Fixed in: 18.10.8-r8.
- Products
- gitlab-rails-ce-fips-18.10
- Affected versions
- Not specified
- Fixed versions
- 18.10.8-r8
- CVEs
- CVE-2026-39821
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 11:57 UTC · Revision 1
Source evidence
CGA-x5mh-3fx7-8vfc
osv:CGA-x5mh-3fx7-8vfc
gitlab-rails-ce-fips-18.10
Fixed versions: 18.10.8-r8
Complete source record
{
"id": "61090ee8af55c25bdd1eef6b101447bbbc615dae7c9394ec29e94a1d4d7c61bf",
"url": "https://osv.dev/vulnerability/CGA-x5mh-3fx7-8vfc",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CGA-x5mh-3fx7-8vfc",
"summary": "CGA-x5mh-3fx7-8vfc",
"evidence": "osv:CGA-x5mh-3fx7-8vfc",
"products": [
{
"name": {
"value": "gitlab-rails-ce-fips-18.10",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "18.10.8-r8",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "CGA-x5mh-3fx7-8vfc",
"aliases": [
"CGA-x5mh-3fx7-8vfc"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "18.10.8-r8"
}
]
}
],
"package": {
"name": "gitlab-rails-ce-fips-18.10",
"purl": "pkg:apk/chainguard/gitlab-rails-ce-fips-18.10?arch=x86_64",
"ecosystem": "Chainguard"
},
"database_specific": {
"source": "https://advisories.cgr.dev/chainguard/v3/osv/CGA-x5mh-3fx7-8vfc.json"
},
"ecosystem_specific": {
"components": [
{
"component_name": "stdlib",
"component_purl": "pkg:golang/stdlib@go1.26.5",
"component_type": "go-module",
"component_version": "go1.26.5",
"component_location": "/srv/gitlab/vendor/bundle/ruby/3.3.0/gems/devfile-0.5.0-x86_64-linux/out/devfile-amd64-linux",
"latest_event_status": "fixed",
"latest_event_timestamp": "2026-10-09T03:43:22Z"
}
]
}
}
],
"modified": "2026-10-09T10:18:08.859854355Z",
"provider": "osv",
"upstream": [
"CVE-2026-39821",
"GHSA-w2q5-6q6x-x959",
"GO-2026-5026"
],
"references": [
"https://go.dev/cl/767220",
"https://go.dev/issue/78760",
"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"https://pkg.go.dev",
"https://pkg.go.dev/vuln/GO-2026-5026",
"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json",
"https://access.redhat.com/errata/RHSA-2026:23262",
"https://access.redhat.com/errata/RHSA-2026:23264",
"https://access.redhat.com/errata/RHSA-2026:26546",
"https://access.redhat.com/errata/RHSA-2026:26547",
"https://access.redhat.com/errata/RHSA-2026:30650",
"https://access.redhat.com/errata/RHSA-2026:30651",
"https://access.redhat.com/errata/RHSA-2026:30853",
"https://access.redhat.com/errata/RHSA-2026:30854",
"https://access.redhat.com/errata/RHSA-2026:30855",
"https://access.redhat.com/errata/RHSA-2026:33155",
"https://access.redhat.com/errata/RHSA-2026:33160",
"https://access.redhat.com/errata/RHSA-2026:33163",
"https://access.redhat.com/errata/RHSA-2026:33173",
"https://access.redhat.com/errata/RHSA-2026:33183",
"https://access.redhat.com/errata/RHSA-2026:33524",
"https://access.redhat.com/errata/RHSA-2026:33531",
"https://access.redhat.com/errata/RHSA-2026:34342",
"https://access.redhat.com/errata/RHSA-2026:34357",
"https://access.redhat.com/errata/RHSA-2026:34359",
"https://access.redhat.com/errata/RHSA-2026:34364",
"https://access.redhat.com/errata/RHSA-2026:34789",
"https://access.redhat.com/errata/RHSA-2026:35826",
"https://access.redhat.com/errata/RHSA-2026:35827",
"https://access.redhat.com/errata/RHSA-2026:35828",
"https://access.redhat.com/errata/RHSA-2026:35829",
"https://access.redhat.com/errata/RHSA-2026:35830",
"https://access.redhat.com/errata/RHSA-2026:35831",
"https://access.redhat.com/errata/RHSA-2026:35993",
"https://access.redhat.com/errata/RHSA-2026:35994",
"https://access.redhat.com/errata/RHSA-2026:36167",
"https://access.redhat.com/security/cve/CVE-2026-39821",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39821.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"https://bugzilla.redhat.com/show_bug.cgi?id=2480756",
"https://access.redhat.com/errata/RHSA-2026:36105",
"https://access.redhat.com/errata/RHSA-2026:36207",
"https://access.redhat.com/errata/RHSA-2026:36648",
"https://access.redhat.com/errata/RHSA-2026:36651",
"https://access.redhat.com/errata/RHSA-2026:36796",
"https://access.redhat.com/errata/RHSA-2026:36797",
"https://access.redhat.com/errata/RHSA-2026:36808",
"https://access.redhat.com/errata/RHSA-2026:36820",
"https://access.redhat.com/errata/RHSA-2026:36883",
"https://access.redhat.com/errata/RHSA-2026:37387",
"https://access.redhat.com/errata/RHSA-2026:37435",
"https://access.redhat.com/errata/RHSA-2026:37436",
"https://access.redhat.com/errata/RHSA-2026:38995",
"https://access.redhat.com/errata/RHSA-2026:39005",
"https://access.redhat.com/errata/RHSA-2026:39573",
"https://access.redhat.com/errata/RHSA-2026:39879",
"https://access.redhat.com/errata/RHSA-2026:40118",
"https://access.redhat.com/errata/RHSA-2026:40262",
"https://access.redhat.com/errata/RHSA-2026:40945",
"https://access.redhat.com/errata/RHSA-2026:41019",
"https://access.redhat.com/errata/RHSA-2026:41030",
"https://access.redhat.com/errata/RHSA-2026:41031",
"https://access.redhat.com/errata/RHSA-2026:41036",
"https://access.redhat.com/errata/RHSA-2026:41055",
"https://access.redhat.com/errata/RHSA-2026:41066",
"https://access.redhat.com/errata/RHSA-2026:41930",
"https://access.redhat.com/errata/RHSA-2026:41928",
"https://access.redhat.com/errata/RHSA-2026:42043",
"https://access.redhat.com/errata/RHSA-2026:42047",
"https://access.redhat.com/errata/RHSA-2026:42048",
"https://access.redhat.com/errata/RHSA-2026:42049",
"https://access.redhat.com/errata/RHSA-2026:42050",
"https://access.redhat.com/errata/RHSA-2026:42051",
"https://access.redhat.com/errata/RHSA-2026:42078",
"https://access.redhat.com/errata/RHSA-2026:42079",
"https://access.redhat.com/errata/RHSA-2026:42080",
"https://access.redhat.com/errata/RHSA-2026:42082",
"https://access.redhat.com/errata/RHSA-2026:42132",
"https://access.redhat.com/errata/RHSA-2026:42142",
"https://access.redhat.com/errata/RHSA-2026:42146",
"https://access.redhat.com/errata/RHSA-2026:42150",
"https://access.redhat.com/errata/RHSA-2026:42151",
"https://access.redhat.com/errata/RHSA-2026:42240",
"https://access.redhat.com/errata/RHSA-2026:42644",
"https://access.redhat.com/errata/RHSA-2026:42796",
"https://access.redhat.com/errata/RHSA-2026:42852",
"https://access.redhat.com/errata/RHSA-2026:43038",
"https://access.redhat.com/errata/RHSA-2026:43052",
"https://access.redhat.com/errata/RHSA-2026:43692",
"https://access.redhat.com/errata/RHSA-2026:44624",
"https://access.redhat.com/errata/RHSA-2026:44622",
"https://access.redhat.com/errata/RHSA-2026:46395",
"https://access.redhat.com/errata/RHSA-2026:47149",
"https://access.redhat.com/errata/RHSA-2026:47735",
"https://access.redhat.com/errata/RHSA-2026:47737",
"https://access.redhat.com/errata/RHSA-2026:47952",
"https://access.redhat.com/errata/RHSA-2026:50300",
"https://access.redhat.com/errata/RHSA-2026:50843",
"https://access.redhat.com/errata/RHSA-2026:51033",
"https://access.redhat.com/errata/RHSA-2026:51112",
"https://access.redhat.com/errata/RHSA-2026:51187",
"https://access.redhat.com/errata/RHSA-2026:51194",
"https://access.redhat.com/errata/RHSA-2026:51341",
"https://access.redhat.com/errata/RHSA-2026:52826",
"https://access.redhat.com/errata/RHSA-2026:53374",
"https://access.redhat.com/errata/RHSA-2026:53412",
"https://access.redhat.com/errata/RHSA-2026:53413",
"https://access.redhat.com/errata/RHSA-2026:53415",
"https://access.redhat.com/errata/RHSA-2026:53530",
"https://access.redhat.com/errata/RHSA-2026:54191",
"https://access.redhat.com/errata/RHSA-2026:54283",
"https://access.redhat.com/errata/RHSA-2026:54285",
"https://access.redhat.com/errata/RHSA-2026:54287",
"https://groups.google.com/g/golang-announce/c/94pEornpRlI",
"https://access.redhat.com/errata/RHSA-2026:54274",
"https://access.redhat.com/errata/RHSA-2026:54284",
"https://access.redhat.com/errata/RHSA-2026:54286",
"https://access.redhat.com/errata/RHSA-2026:54395",
"https://access.redhat.com/errata/RHSA-2026:54401",
"https://access.redhat.com/errata/RHSA-2026:54435",
"https://access.redhat.com/errata/RHSA-2026:54441",
"https://access.redhat.com/errata/RHSA-2026:54531",
"https://access.redhat.com/errata/RHSA-2026:54757",
"https://access.redhat.com/errata/RHSA-2026:54580",
"https://access.redhat.com/errata/RHSA-2026:56143",
"https://access.redhat.com/errata/RHSA-2026:56223",
"https://access.redhat.com/errata/RHSA-2026:56340",
"https://access.redhat.com/errata/RHSA-2026:56431",
"https://access.redhat.com/errata/RHSA-2026:57194",
"https://access.redhat.com/errata/RHSA-2026:57541",
"https://access.redhat.com/errata/RHSA-2026:49702",
"https://access.redhat.com/errata/RHSA-2026:49712",
"https://access.redhat.com/errata/RHSA-2026:57649",
"https://access.redhat.com/errata/RHSA-2026:57845",
"https://access.redhat.com/errata/RHSA-2026:59546",
"https://access.redhat.com/errata/RHSA-2026:59549",
"https://access.redhat.com/errata/RHSA-2026:59562",
"https://access.redhat.com/errata/RHSA-2026:60315",
"https://access.redhat.com/errata/RHSA-2026:60354",
"https://access.redhat.com/errata/RHSA-2026:60387",
"https://access.redhat.com/errata/RHSA-2026:60520",
"https://access.redhat.com/errata/RHSA-2026:61245",
"https://access.redhat.com/errata/RHSA-2026:61253",
"https://access.redhat.com/errata/RHSA-2026:63134",
"https://access.redhat.com/errata/RHSA-2026:65126",
"https://access.redhat.com/errata/RHSA-2026:65153",
"https://access.redhat.com/errata/RHSA-2026:65359",
"https://access.redhat.com/errata/RHSA-2026:65534",
"https://access.redhat.com/errata/RHSA-2026:65886",
"https://access.redhat.com/errata/RHSA-2026:62549",
"https://access.redhat.com/errata/RHSA-2026:66016",
"https://access.redhat.com/errata/RHSA-2026:66022",
"https://access.redhat.com/errata/RHSA-2026:66432",
"https://access.redhat.com/errata/RHSA-2026:67149",
"https://access.redhat.com/errata/RHSA-2026:67159",
"https://access.redhat.com/errata/RHSA-2026:67160",
"https://access.redhat.com/errata/RHSA-2026:66350",
"https://access.redhat.com/errata/RHSA-2026:67287",
"https://access.redhat.com/errata/RHSA-2026:67319",
"https://access.redhat.com/errata/RHSA-2026:67517",
"https://access.redhat.com/errata/RHSA-2026:65851",
"https://access.redhat.com/errata/RHSA-2026:68504"
]
},
"related_cves": [
{
"value": "CVE-2026-39821",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 116870,
"published_at": "2026-08-14T12:01:19+00:00"
}