CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

GitLab CE/EE CI/CD regular-expression compiler integer overflow, unauthenticated code execution (CVSS 10.0); fixed in 19.4.2, 19.3.5 and 19.2.8

cve · CVE-2026-97229

Coverage
1
first 2026-10-13 → last 2026-10-13
Latest activity
2026-10-13
GitLab fixes an unauthenticated CVSS 10.0 code-execution flaw in its CI/CD regex compiler; 19.4.1 is still…
Peak priority
high
1 high
Targets
technology
sectors: technology
Sources cited
5
4 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-97229, newest first. Check the date before acting on an older one.

  • Upgrade every self-managed GitLab CE and EE instance on 19.2, 19.3 or 19.4 to 19.2.8, 19.3.5 or 19.4.2, internet-reachable instances first; 19.4.1 and 19.3.4 remain affected, and GitLab's release page lists no workaround.
    2026-10-13CVE-2026-97229

Defender insights

What each entry about CVE-2026-97229 tells a defender to do, newest first.

2026-10-13HIGHGitLab fixes an unauthenticated CVSS 10.0 code-execution flaw in its CI/CD regex compiler; 19.4.1 is still affected

Exposure · triage · detection

Story timeline

  1. 2026-10-13CVE-2026-97229, GitLab CE/EE: an integer overflow in the CI/CD regular-expression compiler allows unauthenticated code execution on self-managed servers, fixed in 19.4.2, 19.3.5 and 19.2.8; 19.4.1 does not close it (CVSS 10.0)
    trending-vulnerabilitiesGitLab fixes an unauthenticated CVSS 10.0 code-execution flaw in its CI/CD regex compiler; 19.4.1 is still affected

Hunting pivots

Affected products
GitLab Community EditionGitLab Enterprise Edition
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-13/cve-2026-97229-gitlab-ci-regex-compiler-unauthenticated-rce · ATT&CK page ↗

Entries about GitLab CE/EE CI/CD regular-expression compiler integer overflow, unauthenticated code execution (CVSS 10.0); fixed in 19.4.2, 19.3.5 and 19.2.8 (1)

2026-10-13 · view entry permalink →

HIGHCVE-2026-97229NATOA2

CVE-2026-97229, GitLab CE/EE: an integer overflow in the CI/CD regular-expression compiler allows unauthenticated code execution on self-managed servers, fixed in 19.4.2, 19.3.5 and 19.2.8; 19.4.1 does not close it (CVSS 10.0)

GitLab's critical patch release of 2026-10-12 (19.4.2, 19.3.5 and 19.2.8) fixes CVE-2026-97229, an integer overflow in the CI/CD regular-expression compiler that, "under certain conditions", could allow an unauthenticated user to execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration; GitLab scores it CVSS 3.1 10.0 with no privileges required (GitLab, 2026-10-12). Affected are self-managed CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2; GitLab.com already runs the patched version and Dedicated customers need no action (GitLab, 2026-10-12). CERT-EU and BleepingComputer give 19.3.4 as the 19.3 fix, but GitLab's page names 19.3.5 and says 19.3.4 had a merge-request page bug, so the GitLab figure governs (CERT-EU, 2026-10-12; BleepingComputer, 2026-10-12). The 19.4.1 release of 2026-09-23 fixed two flaws from the same reporter in the same component, a double free in the regular-expression parser and an integer overflow in the compiler, both rated for an authenticated user (GitLab, 2026-09-23); CVE-2026-97229 is rated without that requirement, and 19.4.1 is still affected. NCSC Switzerland and CERT-EU both published advisories on 2026-10-12 (NCSC Switzerland, 2026-10-12; CERT-EU, 2026-10-12); NCSC lists the exploitation status as unknown, and no source reports exploitation or a public proof of concept (NCSC Switzerland, 2026-10-12). GitLab publishes the issue detail for a security fix 90 days after the release that carries it (GitLab, 2026-10-12).

Triage: ordinary CI jobs run shells under the runners; only a shell spawned by the GitLab application server processes themselves matches this flaw, not one started inside a runner job.

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2

GitLab (Critical Patch Release 19.4.2, 19.3.5, 19.2.8) 2026-10-12

Network access to an affected self-managed instance and delivery of a crafted regular expression through CI/CD configuration

NCSC Switzerland (Security Hub advisory) 2026-10-12

CERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances.

CERT-EU 2026-10-12
vulnerability13 Oct 03:42Zmulti-sourceOpen finding →
Sources: GitLab (Critical Patch Release 19.4.2, 19.3.5, 19.2.8) · CERT-EU · NCSC Switzerland (Security Hub advisory) · BleepingComputer · GitLab (Critical Patch Release 19.4.1, 19.3.3, 19.2.7)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • docs.gitlab.com2 (40%)
  • bleepingcomputer.com1 (20%)
  • cert.europa.eu1 (20%)
  • security-hub.ncsc.admin.ch1 (20%)

External references

NVD · cve.org · CISA KEV

All cited sources (5)