Approved changes feed: RSS · Atom
cpe:2.3:a:gitlab:gitaly:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Gitlab (57573e99-56e6-5fad-895e-0ce7fffc5b90) |
|---|---|
| Product | Gitaly (15756b41-a2ec-5035-9435-69669742f21f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/gitaly |
purl2cpe | 2026-06-01 10:14:46.769023 |
pkg:github/jackstack24/gitaly-mirror |
purl2cpe | 2026-06-01 10:14:46.769026 |
pkg:github/tnir/gitaly |
purl2cpe | 2026-06-01 10:14:46.769029 |
pkg:gitlab/gitlab-org/gitaly |
purl2cpe | 2026-06-01 10:14:46.769032 |
pkg:rpm/opensuse/gitaly |
purl2cpe | 2026-06-01 10:14:46.769034 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-9204 |
vulnerable | 2026-07-29 01:09:06.788143 |
Server-Side Request Forgery (SSRF) in GitLab
MEDIUM (5.3)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to read arbitrary files from the Gitaly server and access internal network resources during repository import, due to insufficient validation of secondary URLs.
Published: 2026-06-11T10:19:51.431Z
Updated: 2026-06-11T12:38:17.055Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-1094 |
vulnerable | 2026-06-08 07:47:14.310825 |
Improper Validation of Unsafe Equivalence in Input in GitLab
MEDIUM (4.6)
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4 that could have allowed an authenticated developer to hide specially crafted file changes from the WebUI.
Published: 2026-02-11T11:04:35.229Z
Updated: 2026-02-11T21:18:35.282Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-13353 |
vulnerable | 2026-06-08 05:18:00.512133 |
Details available
LOW (2.5)
When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above.
Published: 2020-11-17T00:26:35.000Z
Updated: 2024-08-04T12:18:17.588Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.