CVE-2026-97229, GitLab CE/EE: an integer overflow in the CI/CD regular-expression compiler allows unauthenticated code execution on self-managed servers, fixed in 19.4.2, 19.3.5 and 19.2.8; 19.4.1 does not close it (CVSS 10.0)

GitLab's critical patch release of 2026-10-12 (19.4.2, 19.3.5 and 19.2.8) fixes CVE-2026-97229, an integer overflow in the CI/CD regular-expression compiler that, "under certain conditions", could allow an unauthenticated user to execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration; GitLab scores it CVSS 3.1 10.0 with no privileges required (GitLab, 2026-10-12). Affected are self-managed CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2; GitLab.com already runs the patched version and Dedicated customers need no action (GitLab, 2026-10-12). CERT-EU and BleepingComputer give 19.3.4 as the 19.3 fix, but GitLab's page names 19.3.5 and says 19.3.4 had a merge-request page bug, so the GitLab figure governs (CERT-EU, 2026-10-12; BleepingComputer, 2026-10-12). The 19.4.1 release of 2026-09-23 fixed two flaws from the same reporter in the same component, a double free in the regular-expression parser and an integer overflow in the compiler, both rated for an authenticated user (GitLab, 2026-09-23); CVE-2026-97229 is rated without that requirement, and 19.4.1 is still affected. NCSC Switzerland and CERT-EU both published advisories on 2026-10-12 (NCSC Switzerland, 2026-10-12; CERT-EU, 2026-10-12); NCSC lists the exploitation status as unknown, and no source reports exploitation or a public proof of concept (NCSC Switzerland, 2026-10-12). GitLab publishes the issue detail for a security fix 90 days after the release that carries it (GitLab, 2026-10-12).

Triage: ordinary CI jobs run shells under the runners; only a shell spawned by the GitLab application server processes themselves matches this flaw, not one started inside a runner job.