GitLab’s Patch Count Fell While Atlassian Stayed Critical

GitProtect.io tallied 236 DevOps platform patches in 2025, and 59% of them were high or critical. GitLab still led with 129, down 16% from 153 in 2024, while Atlassian logged 87 and rated every one high or critical.

The year’s perfect 10.0 scores sat in a Bitbucket library, a Jira XML parser, and a composite GitHub Action, not in first-party platform code.

GitLab Still Led, With 129 Patches Down 16%

Of the 236 patches GitProtect.io logged across GitHub, GitLab, Azure DevOps, Jira, and Bitbucket, more than half came from GitLab. That 129-fix year was still a drop from 153 in 2024, the only clear decline in the set.

Only two of those GitLab issues were critical, and both lived in the same place: the ruby-saml library used when SAML single sign-on is on. The rest of GitLab’s year was volume, not a pile of top-score holes.

GitProtect.io, part of Xopero Software, sells backup products for these same platforms and is used by more than 2,000 organizations in more than 60 countries. Its 236 patched DevOps platform flaws sit inside the wider DevOps Threats Unwrapped Report 2026, which also tracks outages and incidents. Daria Kulikova, head of GitProtect Lab, said the firm has been running this review for a third year, looking at malware, ransomware, outages, and downtime that can wipe data and raise costs.

Severity still got worse as the calendar ran. High-severity flaws went from 39 in the first half to 87 in the second, more than double. Critical patches went from 4 to 10 over the same split. The year broke down as 14 critical, 126 high, 75 medium, and 21 low.

Every Atlassian Fix Came in High or Critical

Atlassian accounted for 87 of the 236 patches: 48 in Bitbucket and 39 in Jira. GitProtect.io rated the entire block high or critical, and it said Bitbucket’s total was up 58% from 2024. No other vendor in the study posted a year with zero medium or low findings.

PATCHES BY PLATFORM IN 2025

Those four rows add to 236. GitLab’s 129 is the hunting program that still ships the most fixes. Atlassian’s 87 is the severity floor that never dropped. GitHub and Azure DevOps barely move the count and still show up in the critical column.

GitProtect.io put scale behind that split: more than 180 million developers and 630 million repositories on GitHub, 50 million users on GitLab, and 15 million developers on Bitbucket managing about 30 million repositories. A high-severity hole on any of those platforms reaches people who do not run the vendor’s patch calendar.

What the Two GitLab Criticals Allowed

CVE-2025-25291 and CVE-2025-25292 are authentication bypasses in ruby-saml. GitLab uses that library when SAML SSO is enabled at the instance or group level. On a vulnerable CE or EE instance, an attacker who already holds a valid signed SAML document from the identity provider could sign in as another valid user in that same SAML environment.

GitHub Security Lab described parser differentials in ruby-saml as the root: ReXML and Nokogiri can build different document trees from the same XML, which lets an attacker wrap a signature and pass a forged assertion. Peter Stöckli of that lab found CVE-2025-25292. A researcher known as ahacker1 reported CVE-2025-25291 through GitLab’s HackerOne program. Sixto Martin Garcia, maintainer of the ruby-saml gem, worked on the fix.

Attackers who are in possession of a single valid signature that was created with the key used to validate SAML responses or assertions of the targeted organization can use it to construct SAML assertions themselves and are in turn able to log in as any user.

GitHub Security Lab, ruby-saml advisory for CVE-2025-25291 and CVE-2025-25292

GitLab’s own notes are slightly tighter. The March 12, 2025 GitLab patch says the bypass needs a valid signed SAML document, and a mitigation note says the attacker must have compromised a valid user account. GitLab.com was already patched. Self-managed sites were told to move to 17.9.2, 17.8.5, or 17.7.7. The same release also fixed a high-severity issue in the third-party graphql gem and a string of medium and low bugs, which is the mix GitLab actually ships in a busy month.

The SAML impersonation write-ups moved in public because they described a working log-in-as-anyone trick in a library many products share. A year-end scorecard of 236 patches did not. That gap is why GitLab can lead the tally, cut it 16%, and still have its only two criticals live outside its own code.

Bitbucket’s Third-Party 10.0 and Atlassian’s Caveat

Two Atlassian issues carried a CVSS score of 10.0. CVE-2024-38999 is remote code execution in Bitbucket Data Center and Server through a third-party dependency, scored 10.0 on CVSS 3.1 with a network vector, no privileges, no user click, and changed scope. Atlassian said it was introduced across the 8.19.0 to 8.19.15 line and told customers to move to 8.19.25 or later.

The ticket is explicit that the hole is not Atlassian-written code, and that the firm filed it in a monthly bulletin rather than a critical advisory because it judged product risk lower than the library score.

This is a critical vulnerability in a non-Atlassian Bitbucket dependency. However, Atlassian’s application of the dependency presents a lower assessed risk, which is why we are disclosing this vulnerability in our monthly Security Bulletin instead of a Critical Security Advisory.

Atlassian, Bitbucket Data Center and Server ticket for CVE-2024-38999

CVE-2025-66516 is the other 10.0: XML external entity injection in Jira Software Data Center and Server, via Apache Tika, hitting confidentiality, integrity, and availability. The underlying bug is in tika-core. A crafted XFA file inside a PDF can trigger XXE. Atlassian said the issue showed up in 9.12.28, told customers to move to 9.12.29 or later, and also said its use of the library does not support the known exploit path, so the patch went out of caution. GitProtect.io still counted both as maximum scores against Atlassian.

That is the loser column in plain numbers. Bitbucket’s 48 patches, up 58%, and Jira’s 39, with a severity floor of high, are what make a 16% GitLab decline look like a different company. The non-Atlassian Bitbucket dependency is also why a 10.0 on a slide can be a library CVE that the vendor itself will not treat as a critical advisory.

GitHub Cloud Carried Four Criticals in 18 Patches

GitHub patched 18 vulnerabilities in 2025, five on GitHub Enterprise Server and 13 on GitHub Cloud. Four of the Cloud flaws were critical. GitProtect.io flagged one of them as CVE-2025-178, a composite GitHub Action issue with a CVSS score of 10.0 that allowed arbitrary code execution. That CVE string does not match a public NVD record under the same ID, so the claim stays with GitProtect.io’s labeling.

Eighteen patches is 8% of the year. Four Cloud criticals in that small set is the opposite of GitLab’s pattern, where 129 fixes produced two criticals and both were a shared library. Composite Actions are other people’s YAML running with the job’s token. A 10.0 there is a workflow problem customers pull in, then discover only after a tag moves or an input hits a shell.

No Customer Action on the Azure Privilege Bug

Microsoft patched two critical Azure DevOps issues in 2025. GitProtect.io named CVE-2025-47158, an authentication bypass by assumed-immutable data that lets an unauthenticated attacker raise privileges on the network. Microsoft scored it 9.0 (CVSS 3.1, high attack complexity, no privileges, no user interaction, changed scope), listed CWE-302, and published it on July 18, 2025. Christian August Holm Hansen of Binary Security is credited. Microsoft said it was not publicly disclosed and not exploited at publication, and that the hosted service needed no customer action.

The same 236-bug year is the one in which Microsoft logged two critical Azure DevOps flaws, a thin count next to GitLab and Atlassian and still a critical pair for anyone running boards, repos, and pipelines on that host. Microsoft’s own advisory frames CVE-2025-47158 as unauthenticated privilege escalation over a network on a service it patched itself.

THE NAMED CRITICALS IN THE TALLY

• CVE-2025-25291 and CVE-2025-25292: GitLab SAML impersonation through ruby-saml, patched in 17.9.2, 17.8.5, and 17.7.7, with ruby-saml itself fixed in 1.18.0 and 1.12.4.
• CVE-2024-38999: Bitbucket Data Center and Server remote code execution in a third-party library, CVSS 10.0, fixed in 8.19.25 and later.
• CVE-2025-66516: Jira XXE through Apache Tika, CVSS 10.0 on Atlassian’s bulletin, tika-core 3.2.2 on the library side, Jira 9.12.29 and later on the product side.
• CVE-2025-47158: Azure DevOps unauthenticated privilege escalation, CVSS 9.0, hosted patch, no customer step.
• CVE-2025-178: GitProtect.io’s label for a composite GitHub Action flaw it scored at 10.0 for arbitrary code execution on Cloud.

Three of those five entries are inherited code. GitLab’s only criticals, Bitbucket’s 10.0, and Jira’s 10.0 all arrived through a gem, a Bitbucket dependency, or Tika. GitHub’s remaining 10.0, as GitProtect.io described it, is a composite Action. Azure’s named bug is first-party, and Microsoft closed it on the service.

79 Patches in the Final Quarter

Volume climbed every quarter, then jumped in the last three months. Q4’s 79 patches were 34% of the year and 76% above Q1’s 45. November alone had 36, or 15% of 2025.

THE 2025 PATCH CALENDAR

1. Q1 2025: 45 patched vulnerabilities.
2. Q2 2025: 52, up 16% from Q1, bringing the first half to 97.
3. Q3 2025: 60, up 15% from Q2.
4. Q4 2025: 79, up 32% from Q3, bringing the second half to 139, a 43% rise from the first half.
5. November 2025: 36 patched vulnerabilities, the peak month.

GitProtect.io ties that late-year pile to pressure on development and security teams as software supply chains get harder to map. The calendar also matches how vendors ship: GitLab’s ruby-saml pair landed in March, Microsoft’s Azure advisory in July, and Atlassian’s Bitbucket 10.0 ticket in November, which is the month that already held 15% of the year’s patches.

GitProtect.io’s closing pitch is the shared-responsibility line it sells against. Platforms patch their own hosts; customers still need copies of repos and metadata they can reach if a vendor incident or a maintenance window locks the UI. That advice sits next to a 16% GitLab decline and an Atlassian year in which every listed bug was high or critical. A Bitbucket admin still on 8.19.15 had a CVSS 10.0 third-party RCE until 8.19.25. A Jira admin on 9.12.28 had a Tika XXE Atlassian itself said was scored for the library, not for the way Jira calls it.

Frequently Asked Questions

Which GitLab Versions Fixed the ruby-saml Bypass?

Self-managed GitLab CE and EE needed 17.9.2, 17.8.5, or 17.7.7, shipped on March 12, 2025; GitLab.com was already on the patched build, and Dedicated customers were told they would be moved. Sites that could not upgrade immediately were told to enforce GitLab two-factor on every account, disable the SAML two-factor bypass, and require admin approval for auto-created users. The library itself is patched in ruby-saml 1.18.0 and 1.12.4, and omniauth-saml had to move to a release that pulls those versions.

Did Atlassian Treat the Bitbucket 10.0 as a Critical Advisory?

No. CVE-2024-38999 went out in a monthly security bulletin, not a critical security advisory, because Atlassian judged that its use of the third-party code presented lower risk than the CVSS 10.0 assigned to the library. Affected Bitbucket Data Center and Server releases were 8.19.0 through 8.19.15. The fixed line starts at 8.19.25. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, which is unauthenticated network RCE with changed scope.

Does CVE-2025-47158 Need a Patch on Azure DevOps?

Microsoft’s July 18, 2025 advisory says the CVE requires no customer action because it is an exclusively hosted service Microsoft patched itself. The score is 9.0, not 10.0, with high attack complexity. At publication Microsoft listed the bug as not publicly disclosed and not exploited, and credited Christian August Holm Hansen of Binary Security. GitProtect.io still counted it among two critical Azure DevOps fixes in 2025.

What Does CVE-2025-66516 Exploit in Jira?

The issue is XML external entity injection in Apache Tika, triggered by a crafted XFA file inside a PDF, and Atlassian shipped a Jira Software Data Center and Server patch because Jira bundles that parser. Tika’s own fix is tika-core 3.2.2. Jira 9.12.28 is the version Atlassian marked as introducing the issue, and 9.12.29 is the first 9.12 fix line. Atlassian said its product path does not match the known exploit and that the Jira update was released out of caution.