CyberSecBulletin
CVE-2026-97229Exploited in the wildNVD status: Analyzed

GitLab CI/CD regex flaw allows server code execution; upgrade to 19.4.2, 19.3.5 or 19.2.8

Published Updated By the CyberSecBulletin desk

A critical integer overflow in GitLab CE and EE lets a user run code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. CISA has added it to its Known Exploited Vulnerabilities catalog, so treat it as urgent. Upgrade self-managed instances to 19.2.8, 19.3.5 or 19.4.2 now, and check for the detection signatures GitLab published.

CVE-2026-97229 is a critical-severity integer overflow or wraparound vulnerability in GitLab, with a CVSS 3.1 base score of 10.0 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 19.2.8, 19.3.5, 19.4.2 as the first without the flaw, so updating GitLab to one of those releases or later removes the exposure. CISA added it to the Known Exploited Vulnerabilities catalogue on October 29, 2026, which means attacks have been observed in the wild.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What happened

GitLab disclosed and patched the flaw in its October 12, 2026 critical patch release. The weakness is an integer overflow, a calculation that exceeds the size the software allows and wraps to an incorrect value. In this case, the bad value is produced while the server compiles a regular expression supplied through CI/CD configuration.

The bug sits in Ruby's regular expression engine, which GitLab uses to compile patterns. GitLab reported it to Ruby, and Ruby released fixes on October 23, 2026 in Ruby 4.0.8, 3.4.12 and 3.3.13. Johan Carlsson (joaxcar) reported the issue through GitLab's HackerOne bug bounty program.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 29, 2026, with a remediation due date of November 1, 2026. A public exploit module for the Metasploit testing framework was published on GitHub on October 14, 2026.

Who is affected

GitLab CE and EE versions from 19.2 before 19.2.8, from 19.3 before 19.3.5, and from 19.4 before 19.4.2 are affected. Fixed versions are 19.2.8, 19.3.5 and 19.4.2. GitLab.com and GitLab Dedicated tenants are already patched. Self-managed installations of any deployment type are affected unless the sources state otherwise, and GitLab says that when no deployment type is named, all types are affected.

How an attack would work

GitLab's advisory describes an unauthenticated user exploiting the flaw. The public exploit module, however, needs a valid account that can write to a public project. Either way, the attacker submits a crafted CI/CD configuration that the server processes, and the flaw is triggered during that processing. Exposed instances with open sign-up or weak account controls carry the most risk. The attack is rated network-reachable, low complexity and needing no user interaction.

A successful attacker can run code as the account that runs GitLab on the server. That gives access to repositories, CI/CD secrets and other data the instance holds, and the ability to disrupt the service. The vendor rates the flaw 10.0 on the CVSS scale, the highest score, with high impact to confidentiality, integrity and availability. For an organisation, a compromised GitLab server is often a route into the software build pipeline and the code it produces.

What to do

  1. Upgrade every self-managed GitLab CE or EE instance to 19.2.8, 19.3.5 or 19.4.2, matching your release line. GitLab calls the upgrade immediate.
  2. Prioritise internet-facing instances and any instance that allows user sign-up or untrusted users to create projects.
  3. If you cannot patch at once, follow the vendor's mitigation guidance and limit who can create or change CI/CD configuration. CISA's required action says to discontinue use of the product if mitigations are unavailable.
  4. If you run your own Ruby applications that compile regular expressions from untrusted input, upgrade to Ruby 4.0.9, 3.4.12 or 3.3.13 or later. Ruby's team says that avoiding such input is the alternative.
  5. Review the GitLab patch release notes for the other security fixes shipped in the same release.

How to check whether you are exposed

  • Check each GitLab instance's version against the affected ranges. Any version below 19.2.8 on the 19.2 line, below 19.3.5 on the 19.3 line, or below 19.4.2 on the 19.4 line is exposed.
  • Deploy the six threat detections GitLab published for self-managed instances. They are named Onigmo native worker crash, Graphql cilint hostile regexp, ci regexp oversized non ascii path, ci regexp guard rejection, ci lint workhorse worker crash, and ci lint scripted client error burst.
  • Review web and application logs for CI lint requests with unusually long or unusual regular expressions, and for Puma worker crashes, which the public exploit module can cause.

Affected products and versions

VendorProductAffected versionsFixed in
GitLabGitLab19.2 up to, but not including, 19.2.8; 19.3 up to, but not including, 19.3.5; 19.4 up to, but not including, 19.4.219.2.8, 19.3.5, 19.4.2
Ruby-langRuby3.3.0 up to, but not including, 3.3.13; 3.4.0 up to, but not including, 3.4.12; 4.0.0 up to, but not including, 4.0.83.3.13, 3.4.12, 4.0.8

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Scored by CNA (gitlab.com).

Official description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

How developers prevent this class of flaw

  • Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.
  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. If possible, choose a language or compiler that performs automatic bounds checking.
  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Use libraries or frameworks that make it easier to handle numbers without unexpected consequences. Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++).

More Integer Overflow or Wraparound vulnerabilities (CWE-190)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: active, automatable: yes, technical impact: total).
  3. Added to CISA's Known Exploited Vulnerabilities catalogue.
  4. Deadline for US federal agencies to remediate, set by CISA.
  5. Our analysis was written from the record and vendor references.
  6. Record last changed materially (score, affected products, status or references).

Common questions

Is CVE-2026-97229 being exploited in the wild?
CISA has listed it in its Known Exploited Vulnerabilities catalog, which means CISA has evidence of active exploitation. The catalog entry was added on October 29, 2026, with a remediation due date of November 1, 2026.
Which GitLab versions should I upgrade to?
Upgrade to 19.2.8 if you run the 19.2 line, 19.3.5 for 19.3, or 19.4.2 for 19.4. Versions before these fixed releases on each line are affected.
Does this affect GitLab.com or GitLab Dedicated?
No. GitLab says GitLab.com is already running the patched version, and all GitLab Dedicated tenants were patched before the public release. Self-managed installations need to apply the update themselves.

References

Patches and release notes

Other references

Our coverage

Other vulnerabilities in GitLab

All GitLab vulnerabilities

Recent Integer Overflow or Wraparound vulnerabilities

Spotted an error? Tell us.