GITLAB has issued an urgent patch for CVE-2026-97229, a critical unauthenticated remote code execution flaw in the CI/CD Regular Expression Compiler. Classified with a CVSS v3.1 score of 10.0, the issue arises from an integer overflow when processing a specially crafted regular expression in a CI/CD configuration.
Under certain conditions, this can allow an unauthenticated attacker to execute arbitrary code on a self‑managed GitLab server, potentially giving full control over the instance and access to sensitive data such as CI/CD variables, project data, tokens and credentials, depending on the deployment. GitLab notes that the exact vulnerable function, request path and exploit chain have not been disclosed.
Affected GitLab CE/EE versions and fixed releases are as follows: 19.2 before 19.2.8, with 19.2.8 as the fix; 19.3 before 19.3.5, with 19.3.5 as the fix (19.3.4 was previously referenced as fixed but caused a separate MR-related issue); and 19.4 before 19.4.2, with 19.4.2 as the fix. GitLab’s critical patch releases cover all deployment types unless otherwise stated.
No confirmed in‑the‑wild exploitation had been reported by 13 October 2026, though public claims of PoCs exist and should be treated carefully until validated.
Defenders should upgrade to 19.2.8, 19.3.5, 19.4.2 or newer, and verify the specific application version across containers and Helm deployments. Until patched, restrict unnecessary public access to GitLab, segment CI/CD infrastructure, and monitor for suspicious CI/CD configuration activity, unusual process launches, new tokens or deployments, and anomalous outbound connections. Preserve logs if suspicious activity is observed and investigate credentials and secrets accessible to the GitLab instance.