---
schema: 1
kind: vulnerability
title: "CVE-2026-97229, GitLab CE/EE: an integer overflow in the CI/CD regular-expression compiler allows unauthenticated code execution on self-managed servers, fixed in 19.4.2, 19.3.5 and 19.2.8; 19.4.1 does not close it (CVSS 10.0)"
headline: "GitLab fixes an unauthenticated CVSS 10.0 code-execution flaw in its CI/CD regex compiler; 19.4.1 is still affected"
summary: >
  GitLab's critical patch release of 2026-10-12 fixes CVE-2026-97229 (CVSS 3.1 10.0), an integer overflow in the CI/CD regular-expression compiler that, under certain conditions,
  lets an unauthenticated user execute arbitrary code on the server through a crafted expression in a CI/CD configuration. Self-managed CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5
  and 19.4 before 19.4.2 are affected, GitLab.com already runs the fix, and NCSC Switzerland and CERT-EU both published advisories on 2026-10-12; NCSC lists the exploitation status as unknown.
discovered_at: "2026-10-13T03:42:00Z"
updated_at: null
event_date: "2026-10-12"
run_id: 2026-10-13T0256Z-intel
priority: high
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, patch-available]
regions: [global]
sectors: [technology]
entities: []
techniques: [T1190]
affected_products: ["GitLab Community Edition", "GitLab Enterprise Edition"]
cves:
  - id: CVE-2026-97229
    cvss: "10.0 (CVSS 3.1)"
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "self-managed GitLab CE/EE: 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2"
    fixed: "19.2.8; 19.3.5; 19.4.2"
sources:
  - url: "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/"
    publisher: "GitLab (Critical Patch Release 19.4.2, 19.3.5, 19.2.8)"
    date: "2026-10-12"
    role: primary
  - url: "https://cert.europa.eu/publications/security-advisories/2026-016/"
    publisher: "CERT-EU"
    date: "2026-10-12"
    role: corroborating
  - url: "https://security-hub.ncsc.admin.ch/#/posts/13051"
    publisher: "NCSC Switzerland (Security Hub advisory)"
    date: "2026-10-12"
    role: corroborating
  - url: "https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/"
    publisher: "BleepingComputer"
    date: "2026-10-12"
    role: corroborating
  - url: "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/"
    publisher: "GitLab (Critical Patch Release 19.4.1, 19.3.3, 19.2.7)"
    date: "2026-09-23"
    role: corroborating
closed_sources: []
evidence:
  - quote: "GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation."
    publisher: "GitLab (Critical Patch Release 19.4.2, 19.3.5, 19.2.8)"
    source_url: "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/"
  - quote: "all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2"
    publisher: "GitLab (Critical Patch Release 19.4.2, 19.3.5, 19.2.8)"
    source_url: "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/"
  - quote: "Network access to an affected self-managed instance and delivery of a crafted regular expression through CI/CD configuration"
    publisher: "NCSC Switzerland (Security Hub advisory)"
    source_url: "https://security-hub.ncsc.admin.ch/#/posts/13051"
  - quote: "CERT-EU strongly recommends upgrading self-managed GitLab CE/EE instances to a fixed version as soon as possible, starting with internet-facing instances."
    publisher: "CERT-EU"
    source_url: "https://cert.europa.eu/publications/security-advisories/2026-016/"
verification: multi-source
sourcing_note: >
  GitLab's release page is the primary source for the flaw, the affected versions and the fixed versions; CERT-EU, NCSC Switzerland and BleepingComputer restate it without independent observation.
  CERT-EU and BleepingComputer give 19.3.4 as the 19.3 fix, while GitLab's page names 19.3.5 and says 19.3.4 had a merge-request page bug, so GitLab's figure is used.
  No source states which feature lets an unauthenticated visitor get a CI/CD configuration evaluated.
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Upgrade every self-managed GitLab CE and EE instance on 19.2, 19.3 or 19.4 to 19.2.8, 19.3.5 or 19.4.2, internet-reachable instances first; 19.4.1 and 19.3.4 remain affected, and GitLab's release page lists no workaround."
updates: []
migrated_from: null
---

GitLab's critical patch release of 2026-10-12 (19.4.2, 19.3.5 and 19.2.8) fixes CVE-2026-97229, an integer overflow in the CI/CD regular-expression compiler that, "under certain conditions", could allow an unauthenticated user to execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration; GitLab scores it CVSS 3.1 10.0 with no privileges required ([GitLab, 2026-10-12](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)). Affected are self-managed CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2; GitLab.com already runs the patched version and Dedicated customers need no action ([GitLab, 2026-10-12](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)). CERT-EU and BleepingComputer give 19.3.4 as the 19.3 fix, but GitLab's page names 19.3.5 and says 19.3.4 had a merge-request page bug, so the GitLab figure governs ([CERT-EU, 2026-10-12](https://cert.europa.eu/publications/security-advisories/2026-016/); [BleepingComputer, 2026-10-12](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/)). The 19.4.1 release of 2026-09-23 fixed two flaws from the same reporter in the same component, a double free in the regular-expression parser and an integer overflow in the compiler, both rated for an authenticated user ([GitLab, 2026-09-23](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/)); CVE-2026-97229 is rated without that requirement, and 19.4.1 is still affected. NCSC Switzerland and CERT-EU both published advisories on 2026-10-12 ([NCSC Switzerland, 2026-10-12](https://security-hub.ncsc.admin.ch/#/posts/13051); [CERT-EU, 2026-10-12](https://cert.europa.eu/publications/security-advisories/2026-016/)); NCSC lists the exploitation status as unknown, and no source reports exploitation or a public proof of concept ([NCSC Switzerland, 2026-10-12](https://security-hub.ncsc.admin.ch/#/posts/13051)). GitLab publishes the issue detail for a security fix 90 days after the release that carries it ([GitLab, 2026-10-12](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)).

**Exposure:** self-managed GitLab CE or EE on 19.2.x below 19.2.8, 19.3.x below 19.3.5 or 19.4.x below 19.4.2; GitLab's table starts at 19.2 and lists no earlier branch ([GitLab, 2026-10-12](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)). NCSC Switzerland states the prerequisites as network access to the instance and delivery of a crafted regular expression through CI/CD configuration ([NCSC Switzerland, 2026-10-12](https://security-hub.ncsc.admin.ch/#/posts/13051)); neither GitLab nor NCSC says what the "certain conditions" are, so an instance reachable by untrusted users or networks should be treated as in scope.

**Detection:** GitLab and NCSC publish no indicators, so this is a hunt for the mechanism: in process-creation telemetry, shells, interpreters or network tools started as children of the GitLab application server processes, and in GitLab's audit and application logs, recently created or changed CI/CD configurations that carry unusual regular expressions, from accounts or addresses that have not used the instance before. A server where that turns up needs its CI/CD variables, runner registration tokens and deploy keys treated as exposed.

**Triage:** ordinary CI jobs run shells under the runners; only a shell spawned by the GitLab application server processes themselves matches this flaw, not one started inside a runner job.

**Defender takeaway:** upgrade to 19.4.2, 19.3.5 or 19.2.8 now, starting with internet-facing instances as CERT-EU advises ([CERT-EU, 2026-10-12](https://cert.europa.eu/publications/security-advisories/2026-016/)); GitLab's release page lists no workaround as of 2026-10-13, so an instance that cannot be upgraded this week should be kept off untrusted networks; on a single-node instance the upgrade causes downtime, because migrations must finish before GitLab can start, so schedule the window now ([GitLab, 2026-10-12](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)).