CISA adds maximum-severity GitLab flaw CVE-2026-97229 to exploited vulnerabilities catalogue
- Severity
- Critical
- Highest CVSS
- 10.0
- Exploited
- Yes
- Sources
- 4
What happened
CVE-2026-97229 is an integer overflow or wraparound (CWE-190) caused by insufficient checks on regular expressions in CI/CD configurations, allowing unauthenticated arbitrary code execution on GitLab CE and EE servers (CVSS 10.0). Reported affected branches are 19.2 before 19.2.8, 19.3 before 19.3.4 and 19.4 before 19.4.2, with fixes released on 12 October. CISA listed it in the KEV catalogue on 29 October 2026 with a remediation deadline of 1 November 2026, and forensic triage is required under BOD 26-04; ransomware use is listed as unknown. Defenders should patch, check for signs of compromise before the update, and note that the fix does not address the separate regex flaw CVE-2026-110264. SecurityWeek's headline reports exploitation against Alpine Linux, but the articles give no further detail.
For security analysts · Written by AI from 4 sources · Wrong?
What to do
- Update Gitlab to the fixed version for your release line (fixes CVE-2026-110264): 18.11.13, 19.0.10, 19.1.9, or see the CVE page for other lines.
- Update Gitlab to the fixed version for your release line (fixes CVE-2026-97229): 19.2.8, 19.3.5 or 19.4.2.
- CVE-2026-97229 is being exploited: treat it as urgent.
- Check whether you use Gitlab: add it to your watchlist to hear when it is affected. Open your watchlist
Based on advisory data
Vulnerabilities
- CVE-2026-110264CVSS 10.0An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to exec
- CVE-2026-97229CVSS 10.0ExploitedGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expressi
Full story timeline · 7 updates
- Tue 13 OctoberCVE-2026-97229 published, CVSS 10.0NVD
- Thu 22 OctoberCVE-2026-110264 published, CVSS 10.0NVD
- Max-severity GitLab bug allows remote code execution over 12 years of releasesThe Register (Security)
- Thu 29 OctoberCVE-2026-97229 added to CISA’s exploited listCISA KEV
- Fri 30 OctoberCISA Warns of GitLab Integer Overflow Vulnerability Exploited in AttacksCyber Security News
- Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxSecurityWeek
- CISA Confirms Active Exploitation of GitLab Vulnerability CVE-2026-97229GBHackers
Who reported · 4 outlets
Who and what is in it
Products