Live › vulnerability › CVE-2026-97229
GitLab Community and Enterprise Edition have an integer overflow in regular expression handling for CI/CD configuration. An unauthenticated attacker who submits a specially crafted regular expression can execute arbitrary code on the GitLab server, and CISA lists the flaw as exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 20:25 UTC, 0h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Self-managed GitLab Community Edition and Enterprise Edition servers are the exposed systems, because the flaw is reached through CI/CD configuration processing. Sources do not list affected or fixed versions, and do not say whether GitLab.com-hosted instances are affected. Teams running GitLab themselves should check their version against GitLab's advisory.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| GitLab Community Edition and Enterprise Edition | vendor | – | – |
| gitlab | vendor | >= 19.2.0, < 19.2.8 | 19.2.8 |
| gitlab |
| vendor |
| >= 19.3.0, < 19.3.5 |
| 19.3.5 |
| gitlab | vendor | >= 19.4.0, < 19.4.2 | 19.4.2 |
Unknown from the sources.
Upgrade to 19.2.8 / 19.3.5 / 19.4.2
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@rapid7 · X21 likes · 10 reposts2026-10-13 17:44“🚨 On 10/12/26, #GitLab published a critical patch release for CVE-2026-97229 affecting GitLab Community Edition (CE) & Enterprise Edition (EE). Today, Rapid7 Intelligence has reproduced arbitrary code execution on an unpatched, official CE image. More: https://t.co/OrRby2FN36 https://t.co/F9WbNrmF0L”
View on X
Hacker News · Hacker News1 points2026-10-28 23:45“GitLab Security Incident: Attempted Exploitation of CVE-2026-97229 https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html”
View on Hacker News
@campuscodi.risky.biz · Bluesky1 likes · 0 reposts2026-10-29 18:07“Alpine Linux says it was almost hacked using a recent GitLab bug alpinelinux.org/posts/GitLab... https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html”
View on Bluesky
Posts are quoted with a link to the original. They are data to us, never instructions.
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2026-97229")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.