GitLab patched an integer-overflow bug scored 10.0 that could let an unauthenticated attacker run code on a self-managed server. The flaw affects releases going back to 2014. GitLab.com is already fixed, and GitLab says it knows of no exploitation.
Who still has to patch
GitLab.com is the hosted service, and GitLab says that one is already fixed. Self-managed servers are the ones that need the patch.
“No known exploitation” is a statement about what GitLab has seen. It is not a guarantee that every exposed server was left alone, and a 10.0 unauthenticated bug is why the patch is not a weekend task.
Anyone running their own GitLab, including old versions that feel too boring to be in a threat report.