What’s Vulnerable › Vulnerabilities
CVE-2026-97229: Integer Overflow or Wraparound in GitLab
- Severity: critical (CVSS 10.0 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2026-10-29
- EPSS: 27.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-13 · updated 2026-10-31
- Weakness: CWE-190
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Summary
CVE-2026-97229 is a critical integer overflow/wraparound flaw in GitLab CE/EE caused by insufficient regular expression validation, allowing an unauthenticated attacker to execute arbitrary code on the GitLab server via a specially crafted regex in a CI/CD configuration (CVSS 10.0). It affects all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation and an 18.4% EPSS probability of exploitation in 30 days. Upgrade to 19.2.8, 19.3.5, or 19.4.2 immediately and follow CISA BOD 26-04 guidance, including evaluating internet exposure and applying forensics triage requirements.
CVE-2026-97229 هو خلل حرج من نوع طفح صحيح أو التفاف في GitLab ناتج عن تحقق غير كافٍ من التعبيرات النمطية، ويسمح لمستخدم غير مصادق عليه بتنفيذ تعليمات برمجية عشوائية على خادم GitLab عبر تعبير نمطي مصمم خصيصاً في إعداد CI/CD (بدرجة CVSS 10.0). يؤثر الخلل في جميع الإصدارات من 19.2 قبل 19.2.8، و19.3 قبل 19.3.5، و19.4 قبل 19.4.2. وهو مدرج في كتالوج الثغرات المعروفة المستغلة لدى CISA مع استغلال نشط واحتمال استغلال بنسبة 18.4% خلال 30 يوماً وفق EPSS. يجب الترقية فوراً إلى 19.2.8 أو 19.3.5 أو 19.4.2 واتباع إرشادات CISA BOD 26-04، بما في ذلك تقييم تعرض الأصول للإنترنت وتطبيق متطلبات التحليل الجنائي.
Affected products
- GitLab: from 19.2.0 before 19.2.8; from 19.3.0 before 19.3.5; from 19.4.0 before 19.4.2 — fixed in 19.2.8, 19.3.5, 19.4.2
- GitLab: from 19.2 before 19.2.8; from 19.3 before 19.3.5; from 19.4 before 19.4.2 — fixed in 19.2.8, 19.3.5, 19.4.2
How to fix
Upgrade to a fixed version: GitLab 19.2.8, 19.3.5, 19.4.2; GitLab 19.2.8, 19.3.5, 19.4.2. Check the vendor advisory for mitigations.
In the news
- Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
- CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV
- Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
- 2026-016: Critical Vulnerability in GitLab CE and EE
- Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
- CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab
References
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
- https://gitlab.com/gitlab-org/gitlab/-/work_items/630686
- https://hackerone.com/reports/4055749
- https://hackerone.com/reports/4058589
- https://github.com/rapid7/metasploit-framework/pull/22017
- https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-97229
Get alerted when CVE-2026-97229 or the next vulnerability affects your stack