---
title: "Comment by Damiano Bianda on \"A CVSS 10.0 Bug Sat Inside GitLab for 12 Years. It Lived in the Regex Engine.\" | Hashnode"
description: "One operational detail worth adding: GitLab's fix shipped as patches to the Ruby bundled in its own packages and images, so anyone running GitLab on a distribut"
url: "https://hashnode.com/posts/a-cvss-10-0-bug-sat-inside-gitlab-for-12-years-it-lived-in-the-regex-engine/6ad9b89b476a7f24ac3d4bc6/comment/6ae46f7c947fdad2e30cc78c"
---

[Discussion](https://hashnode.com/posts/a-cvss-10-0-bug-sat-inside-gitlab-for-12-years-it-lived-in-the-regex-engine/6ad9b89b476a7f24ac3d4bc6)

Comment [A CVSS 10.0 Bug Sat Inside GitLab for 12 Years. It Lived in the Regex Engine.](https://hashnode.com/posts/a-cvss-10-0-bug-sat-inside-gitlab-for-12-years-it-lived-in-the-regex-engine/6ad9b89b476a7f24ac3d4bc6)

[Damiano Bianda](https://hashnode.com/@damianobianda)

[Oct 30](https://hashnode.com/posts/a-cvss-10-0-bug-sat-inside-gitlab-for-12-years-it-lived-in-the-regex-engine/6ad9b89b476a7f24ac3d4bc6/comment/6ae46f7c947fdad2e30cc78c)

One operational detail worth adding: GitLab's fix shipped as patches to the Ruby bundled in its own packages and images, so anyone running GitLab on a distribution or self-built Ruby stays vulnerable even on the latest GitLab version. Alpine Linux's public instance got caught exactly this way in October - they upgraded GitLab twice and remained exploitable until they pulled a Ruby with the fix. If you run self-managed, check the interpreter (3.3.13 / 3.4.12 / 4.0.9+), not just the GitLab version string. CISA put it in KEV with a November 1 due date for federal agencies, so the window is short.