CVE-2019-5464: GitLab

Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days.

A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the library is utilized.

Affected products

• GitLab GitLab: from 10.2.0, before 11.11.7 (fixed in 11.11.7)

Published 2020-01-28. Last modified 2026-06-17.