TL;DR
- Vulnerability: Integer overflow (CWE-190) in GitLab’s CI/CD Regular Expression Compiler
- CVE: CVE-2026-97229
- CVSS: 10.0 (maximum severity)
- Impact: Unauthenticated remote code execution on self-managed GitLab CE/EE instances
- Disclosed: October 12, 2026
- Public PoC: October 13, 2026 (Rapid7 and independent researcher Jonah Burgess)
- Affected versions: GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2
- Status: Patched by GitLab on October 12, 2026. Added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
- Action required: Upgrade self-managed GitLab installations immediately.
October 2026 has been an unusually loud month for critical disclosures across the ecosystem. Along with PHP2Shell, GitLab also joined the party and shipped three critical RCEs in the same month: CVE-2026-90970 (CVSS 9.9) in the self-hosted AI Gateway on October 2, then CVE-2026-97229 (CVSS 10.0) on October 12, and CVE-2026-110264 (CVSS 10.0) on October 21. The last two are integer overflow bugs in the exact same regex compiler, shipped nine days apart.
Among the three, CVE-2026-97229 is the one that has since been added to CISA’s Known Exploited Vulnerabilities catalog, which is the subject of this write-up.
CVE-2026-97229 was discovered by a security researcher operating under the handle “joaxcar” and reported through GitLab’s HackerOne bug bounty program. GitLab released fixed versions on October 12, and a public PoC followed on October 13, independently published by Rapid7 and by researcher Jonah Burgess.
Censys counted 25,766 internet-facing GitLab hosts running affected versions at the time of PoC release, with roughly one in three of all internet-visible GitLab servers still on unpatched builds. The KEV listing now brings CVE-2026-97229 under BOD 26-04 remediation deadlines for federal agencies and makes the clock on exposed self-managed instances officially a shared one.
What is CVE-2026-97229?
CVE-2026-97229 is an integer overflow or wraparound vulnerability (CWE-190) in GitLab’s CI/CD Regular Expression Compiler, which is the component that parses, compiles, and evaluates regular expressions inside project pipeline configuration files.
The flaw sits in how the compiler handles crafted regex input during pipeline-configuration processing. The overflow condition can be triggered through endpoints that validate CI/CD configuration without requiring authentication, which is what pushes the CVSS to 10.0.
The published PoC chain uses GitLab’s CI lint endpoint, the same endpoint CI/CD tooling uses to validate pipeline YAML, as the entry point into the vulnerable code path. Jonah Burgess’s exploit layout was reported as tested against the official Linux amd64 GitLab CE 19.4.1 image.
Impact of CVE-2026-97229
Successful exploitation gives an unauthenticated attacker arbitrary code execution on the GitLab server. From there, the practical blast radius covers the full set of things a GitLab server has access to, including:
- Source code exposure across every repository the server hosts, both public and private.
- CI/CD secret theft, including deployment credentials, cloud API keys, container registry tokens, and signing keys stored as CI/CD variables.
- Supply-chain compromise, in which the attacker modifies pipeline definitions or injects malicious commits that then propagate downstream to every environment the CI/CD pipeline deploys to.
- Lateral movement into the internal network segments that the GitLab server has routable access to, including private cloud workloads and self-hosted runner fleets.
- Persistence via webhook configuration, SSH key injection into user accounts, or runner registration tokens.
The context around CVE-2026-97229 matters as much as the finding itself. September’s CVE-2026-85706, another CVSS 10 in GitLab’s self-managed stack, saw exploitation probes within hours of disclosure and was added to CISA KEV the next day with a three-day federal remediation window.
Fix for CVE-2026-97229
GitLab released fixed versions on October 12, 2026. Upgrade self-managed CE and EE installations to one of the following:
- GitLab 19.2.8 (if currently on 19.2.x)
- GitLab 19.3.5 (if currently on 19.3.x)
- GitLab 19.4.2 (if currently on 19.4.x)
Note on 19.3.5: GitLab initially released 19.3.4 as the patched 19.3 branch, then quickly bumped the recommendation to 19.3.5 because 19.3.4 introduced a separate regression affecting merge request pages when the Ona integration was enabled. If you upgraded to 19.3.4 in the first 24 hours after disclosure, move to 19.3.5.
If you have already patched CVE-2026-97229 on October 12 and have not yet patched CVE-2026-110264, you are still vulnerable to the second regex-compiler bug, which was fixed on October 21 in builds 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. Treat both as a single patch cycle rather than two.
Workaround for CVE-2026-97229
If you cannot patch immediately, the practical interim mitigations are limited for this class of vulnerability because the vulnerable endpoint is part of the core CI/CD surface:
- Restrict network access to the GitLab web interface, keeping it off the public internet wherever possible, so that the attack surface is reduced to internal callers while you schedule the upgrade.
- Monitor the CI lint endpoint and CI/CD configuration processing paths for anomalous unauthenticated requests, unusual regex payload sizes, and unexpected GitLab service behavior. GitLab published two threat detections (“Onigmo native worker crash” and “Org mode render error burst”) alongside the October 21 release that are useful here.
- Rotate CI/CD secrets, deploy keys, and runner registration tokens if there is any uncertainty about whether the instance was reachable from the internet between October 12 and your patch window.
