GitLab Patches Critical Flaw That Could Enable Unauthenticated Remote Code Execution
Summary
GitLab patched CVE-2026-97229, a critical integer overflow in its CI/CD regular expression compiler that could let unauthenticated attackers execute code. Self-managed installations should upgrade; GitLab.com is patched.
Key points
- CVE-2026-97229 affects GitLab’s CI/CD Regular Expression Compiler.
- A specially crafted regular expression in a CI/CD configuration could enable unauthenticated remote code execution.
- The flaw stems from an integer overflow and insufficient regular expression validation.
- Patched versions are 19.2.8, 19.3.4, and 19.4.2; earlier versions in those release branches are affected.
- GitLab urged self-managed installations to upgrade immediately.
- GitLab.com is already patched; GitLab Dedicated customers do not need to take action.
Article Details
- Vulnerability Types
- Integer overflow
- Insufficient regular expression validation
- Remote code execution
- Severity
- Critical / maximum severity
- Affected Versions
- GitLab CE/EE 19.2 before 19.2.8
- GitLab CE/EE 19.3 before 19.3.4
- GitLab CE/EE 19.4 before 19.4.2
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-0723In January, GitLab patched a high-severity two-factor authentication bypass (CVE-2026-0723 that lets attackers who know the target's account ID circumvent two-factor authentication on community and enterprise editionCVE-2026-85706Last month, it addressed another maximum-severity vulnerability (CVE-2026-85706) in GitLab CE/EE that allows unauthenticated attackers to read sensitive data, such as credentials and other secrets, from vulnerableCVE-2026-97229Tracked as CVE-2026-97229, this critical security flaw was discovered by a security researcher using the 'joaxcar' handle and reported via GitLab's HackerOne bug bounty program.