Critical GitLab flaw CVE-2026-97229 allows code execution and is now on CISA's exploited list
- Severity
- Critical
- Highest CVSS
- 10.0
- Exploited
- Yes
- Sources
- 4
What happened
CVE-2026-97229 is an integer overflow (CWE-190) in GitLab's CI/CD regex compiler, rated CVSS 3.1 10.0 with PR:N. It affects GitLab CE and EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2, and was fixed on 12 October 2026. Rapid7 chained a length-check bypass via an inline regex comment with Onigmo recompilation for UTF-8 subjects, reproducing command execution as the git user on 19.4.1-ce.0 with ASLR enabled, and the fix stopped it on 19.4.2. CISA added the CVE to KEV on 29 October 2026. Upgrade to the fixed versions now. As an interim step only, restrict anonymous access to public projects and block untrusted users from creating or writing to them, which does not fix the compiler.
For security analysts · Written by AI from 4 sources · Wrong?
What to do
- Upgrade self-managed GitLab CE or EE to 19.2.8, 19.3.5 or 19.4.2, depending on the release branch in use, without waiting for the normal patch cycle.
- If an upgrade cannot happen immediately, restrict anonymous access to public projects and prevent untrusted users from creating or writing to public projects.
- Check whether any self-managed GitLab instance runs a version before the fixed releases, including instances where new users can self-register.
- GitLab.com is already patched and GitLab Dedicated customers need take no action.
Written by AI from the sources, checked against them
Vulnerabilities
- CVE-2026-97229CVSS 10.0ExploitedGitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expressi
- CVE-2026-97631CVSS 9.5EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrit
Full story timeline · 8 updates
- Tue 13 OctoberCVE-2026-97229 published, CVSS 10.0NVD
- CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLabRapid7 Blog
- Fri 16 OctoberRapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Rapid7 Blog
- Thu 22 OctoberCVE-2026-97631 published, CVSS 9.5NVD
- Tue 27 OctoberCode-execution flaw in UEFI firmware affects most servers on planet EarthArs Technica (Security)
- Wed 28 OctoberCVE-2026-97631: 16-Year-Old UEFI Flaw Threatens ServersSecurity Affairs
- Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution FlawWired (Security)
- Thu 29 OctoberCVE-2026-97229 added to CISA’s exploited listCISA KEV
Who reported · 4 outlets
Who and what is in it
Products