GitLab has patched CVE-2026-97229, a CVSS 10.0 integer-overflow vulnerability in the CI/CD regular-expression compiler that could allow an unauthenticated attacker to execute arbitrary code on a GitLab server through a specially crafted regular expression in a CI/CD configuration. GitLab released fixes for the vulnerability on October 12, 2026, and strongly urged operators of affected self-managed installations to upgrade immediately.
Key Points
- The vulnerability affects self-managed GitLab Community Edition and Enterprise Edition installations.
- An unauthenticated attacker could potentially execute arbitrary code on a vulnerable server.
- GitLab fixed the issue in versions 19.2.8, 19.3.5, and 19.4.2.
- Beazley Security said there was no known exploitation in the wild or public proof of concept at the time of its advisory.
What the flaw affects
GitLab said CVE-2026-97229 results from insufficient validation of regular expressions in its CI/CD regular-expression compiler. Under certain conditions, the integer-overflow issue could allow an unauthenticated user to execute arbitrary code on a GitLab server by supplying a specially crafted expression in a CI/CD configuration.
Beazley Security described the issue as remotely exploitable against self-managed GitLab CE and EE. GitLab assigned the vulnerability a CVSS score of 10.0 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/H:C/I:H/A:H.
Versions and available fixes
GitLab said the affected versions are CE and EE releases from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The vulnerability is fixed in GitLab 19.2.8, 19.3.5, and 19.4.2.
GitLab credited joaxcar, identified as Gothenburg-based security researcher and full-time bug bounty hunter Johan Carlsson, with reporting the vulnerability through the HackerOne bug bounty program. Beazley Security said GitLab had not reported exploitation in the wild and that no public proof of concept was known when Beazley published its advisory.
Upgrade guidance
GitLab recommended that affected self-managed installations upgrade to the applicable fixed release as soon as possible. GitLab.com was already running a patched version, and GitLab Dedicated customers did not need to take action.
The patch includes database migrations. GitLab said single-node installations experience downtime while the migrations complete, while multi-node installations can be upgraded without downtime by following GitLab’s zero-downtime upgrade procedure.
Beazley Security said GitLab had not published a workaround and that upgrading to a fixed release was the only remediation. Organizations unable to patch immediately should restrict access to self-managed instances to trusted networks or a VPN, review recent CI/CD configuration changes including .gitlab-ci.yml files for unexpected or unusually large regular expressions, and rotate stored CI/CD variables, access tokens, and deployment credentials if there is evidence of tampering.
Sources
About the Author
