SECURITYCRITICALCVE-2026-97229

GitLab CVE-2026-97229 CVSS 10 CI/CD Regex RCE Added to CISA KEV

An integer overflow in GitLab's CI/CD regex handling allows code execution on the server. CISA confirmed exploitation on Oct 29; patch to 19.4.2 or 19.2.8.

Dylan H.

Security Team

October 30, 2026
3 min read
GitLab CVE-2026-97229 CVSS 10 CI/CD Regex RCE Added to CISA KEV

Actively exploited

Reported as exploited in the wild (e.g. CISA KEV). Patch or mitigate immediately.

Affected Products

  • GitLab Community Edition (self-managed) before the 19.4.2, 19.3.x and 19.2.8 fixes
  • GitLab Enterprise Edition (self-managed) before the 19.4.2, 19.3.x and 19.2.8 fixes

Executive Summary

CVE-2026-97229 is a CVSS 10.0 integer overflow in the regular expression compiler used for GitLab CI/CD configuration. A specially crafted regular expression can lead to arbitrary code execution on the GitLab server. GitLab shipped an emergency patch release on October 12, 2026, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 29, 2026.

Self-managed GitLab instances that have not applied the October patch release should be treated as exposed.

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-97229
CVSS Score10.0 (Critical)
TypeInteger Overflow or Wraparound (CWE-190)
ComponentCI/CD configuration regular expression handling
ImpactArbitrary code execution on the GitLab server
ExploitationConfirmed (CISA KEV, Oct 29, 2026)

Rapid7's analysis describes the mechanics: a crafted regex compiles as US-ASCII and passes GitLab's validation, then Ruby's Onigmo engine recompiles it as UTF-8 after those checks, where an overflow in the program-size calculation occurs. The underlying defect is in Ruby itself and was fixed in Ruby 4.0.8, 3.4.12 and 3.3.13.

Although the CVSS vector is rated unauthenticated, Rapid7 notes an attacker still needs a way to place a malicious CI/CD configuration into a repository the instance will process.

Exploitation Status

CISA's KEV addition followed a reported incident at Alpine Linux, where an unknown actor attempted to exploit an unpatched GitLab instance on October 20–21, 2026. Crafted CI configurations crashed worker processes eight times; the attempts reportedly did not succeed. Neither CISA nor the reporting identifies the actor or the breadth of exploitation.

This CVE is distinct from CVE-2026-110264, a separate GitLab regex flaw disclosed later in October. Ruby's advisory also lists CVE-2026-89078 and CVE-2026-93577 as related regex fixes, so patch all of them together.

Immediate Remediation

Step 1: Upgrade

Move to a fixed GitLab release for your branch:

BranchFixed Version
19.419.4.2
19.319.3.x patch release (sources cite 19.3.4 and 19.3.5; confirm against GitLab's advisory)
19.219.2.8

Step 2: Review for Abuse

  1. Look for GitLab worker (Sidekiq/Puma) crashes or restarts around CI pipeline creation
  2. Audit recent commits and merge requests that modify .gitlab-ci.yml or included CI files, especially from new or external contributors
  3. Check the GitLab host for unexpected child processes, new accounts, or outbound connections

If Immediate Patching Is Not Possible

  1. Restrict who can push or open merge requests that alter CI configuration
  2. Limit network exposure of the instance to trusted ranges
  3. Increase monitoring on the GitLab host until the upgrade is complete

Post-Remediation Steps

  1. Confirm the running version after upgrade
  2. Rotate CI/CD variables, runner tokens and deploy keys if any crash or suspicious activity was observed
  3. Track the related regex CVEs and Ruby updates in your base images

References