CVE-2026-97229: Integer Overflow or Wraparound in GitLab

Critical severity · published Oct 13, 2026

CVE-2026-97229

Integer Overflow or Wraparound in GitLab

10.0

CVSS

18.4%

EPSS

On KEV

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)18.4% · higher than 97% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

GitLab · GitLab

19.2 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2 · source: vendor, NVD

In the news

VulnerabilityCritical

GitLab Patches Max-Severity Vulnerability CVE-2026-97229

GitLab fixed a critical vulnerability with a maximum CVSS score of 10.0 that could let unauthenticated attackers run code on its servers. GitLab has addressed a critical security flaw, tracked as CVE-2026-97229 (CVSS score of 10.0), that could let attackers run code on its servers without logging in. The flaw affects Community Edition (CE) and […]

CVE-2026-97229

Oct 13, 2026·Security Affairs

VulnerabilityCritical

GitLab admins urged to patch critical RCE flaw (CVE-2026-97229)

GitLab is urging users of self-managed instances to patch a critical vulnerability (CVE-2026-97229) in its CI/CD Regular Expression Compiler that could allow remote attackers to execute arbitrary code on GitLab servers. About CVE-2026-97229 CVE-2026-97229 is an integer overflow vulnerability in GitLab’s CI/CD Regular Expression Compiler, and it affects both GitLab Community Edition (CE) and Enterprise Edition (EE). GitLab has assigned the vulnerability a CVSS score of 10.0, the highest possible. According to the CVSS vector, … More → The post GitLab admins urged to patch critical RCE flaw (CVE-2026-97229) appeared first on Help Net Security .

CVE-2026-97229

Oct 13, 2026·Help Net Security

Affected product

GitLab

All GitLab CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-97229

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-97229

gitlab.com

https://gitlab.com/gitlab-org/gitlab/-/work_items/630686

technical-description

https://hackerone.com/reports/4055749

technical-description

https://hackerone.com/reports/4058589

docs.gitlab.com

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/