GitLab Patches Critical Unauthenticated RCE Vulnerability in CI/CD Regex Compiler
Summary
GitLab patched CVE-2026-97229, a CVSS 10.0 integer-overflow flaw that could enable unauthenticated remote code execution in vulnerable self-managed CE and EE installations. No real-world exploitation has been confirmed.
Key points
- The flaw affects GitLab’s CI/CD Regular Expression Compiler; specially crafted regular expressions can trigger an integer overflow and, under certain conditions, allow arbitrary code execution.
- Affected releases are GitLab 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2.
- GitLab released fixes on October 12, 2026, and urges administrators of self-managed installations to upgrade. GitLab.com is patched; GitLab Dedicated customers need take no additional action.
- The vulnerability was reported through GitLab’s HackerOne program by researcher joaxcar. GitLab has not disclosed the initial report date.
- As of October 12, 2026, real-world exploitation was unconfirmed, and no publicly validated proof of concept was documented in the cited primary sources.
- Administrators should prioritize internet-facing self-managed instances, investigate suspicious CI/CD configuration changes and abnormal server activity, and rotate accessible credentials if compromise is suspected.
Article Details
- Vulnerability Types
- Integer overflow
- Remote code execution
- Severity
- Critical; CVSS 3.1 score 10.0
- Affected Versions
- GitLab CE 19.2 before 19.2.8
- GitLab EE 19.2 before 19.2.8
- GitLab CE 19.3 before 19.3.4
- GitLab EE 19.3 before 19.3.4
- GitLab CE 19.4 before 19.4.2
- GitLab EE 19.4 before 19.4.2
- Exploitation Status
- not_reported
- Exploit Availability
- none_reported
- Patch Status
- available