CVE-2026-97229
Integer Overflow or Wraparound in GitLab
GitLab GitLabApplications & CMSCVSS
10.0CriticalExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.55%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
Vendor and government advisories 1
Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.
Reports 7
3 outlets mention it. Reports are not confirmation; each links to its source.
- Ruby 3.3.13 ReleasedRuby, 23 Oct 2026
- Ruby 3.4.12 ReleasedRuby, 23 Oct 2026
- Ruby 4.0.9 ReleasedRuby, 23 Oct 2026
- Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264Ruby, 23 Oct 2026
- Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Rapid7, 16 Oct 2026Exploit code
- CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLabRapid7, 13 Oct 2026Exploit code
- GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8GitLab releases, 12 Oct 2026
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Text from CVE List
Affected versions 3
- GitLabaffected: 19.2 before 19.2.8CVE List
- GitLabaffected: 19.3 before 19.3.5CVE List
- GitLabaffected: 19.4 before 19.4.2CVE List