GitLab CE/EE CVE-2026-97229 (CVSS 10.0): unauthenticated RCE via integer overflow in the CI/CD Regular Expression Compiler — patch to 19.4.2 / 19.3.4 / 19.2.8

GitLab published a critical patch release on 12 October 2026 (versions 19.4.2, 19.3.4 and 19.2.8 for Community Edition and Enterprise Edition) remediating CVE-2026-97229, an integer overflow in the CI/CD Regular Expression Compiler that, under certain conditions, could let an unauthenticated attacker execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. GitLab rates it CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Impacted self-managed installs are all CE/EE versions from 19.2 before 19.2.8, from 19.3 before 19.3.4, and from 19.4 before 19.4.2. GitLab.com is already patched; GitLab Dedicated customers do not need to act. The advisory does not state that the flaw has been exploited in the wild. Researcher joaxcar reported it via HackerOne. Known issue: 19.3.4 has a bug that affects merge request pages when the Ona integration is enabled; a fix is planned in 19.3.5. The same release also ships other High/Medium fixes (XSS in syntax highlighting, several authorization issues, Duo Agent Platform input neutralization, and more) — this card is the Critical regex RCE only. Primary: GitLab Critical Patch Release 19.4.2/19.3.4/19.2.8 (12 Oct); wire: BleepingComputer and Cybersecurity News (12 Oct).

Product

GitLab Community Edition (CE) and Enterprise Edition (EE) — CI/CD Regular Expression Compiler

Versions

Affected: CE/EE from 19.2 before 19.2.8, 19.3 before 19.3.4, 19.4 before 19.4.2. Fixed: 19.4.2, 19.3.4, 19.2.8. GitLab.com already patched; Dedicated no action.

CVSS

10.0 (GitLab, CVSS 3.1)

Exploited in Australia?

unknown

Patch to

Upgrade self-managed GitLab CE/EE immediately to 19.4.2, 19.3.4 or 19.2.8 (or later). If you run 19.3.4 with the Ona integration, watch for the planned 19.3.5 merge-request page fix. GitLab.com and Dedicated need no customer action for this advisory.

Primary: GitLab Docs — Critical Patch Release: 19.4.2, 19.3.4, 19.2.8 (12 Oct 2026) · Vendor: GitLab — CVE-2026-97229 Integer Overflow in CI/CD Regular Expression Compiler · CVE: CVE-2026-97229 · BleepingComputer — GitLab warns of max severity RCE flaw in regex compiler engine (12 Oct 2026)

vulnerabilities cloud