CVE-2026-97229
GitLab CE/EE integer overflow allows unauthenticated code execution (CVE-2026-97229)
GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2 has a CVSS 10 integer overflow. An unauthenticated attacker can execute code on the GitLab server via a crafted CI/CD regular expression. CISA KEV and ENISA EUVD record exploitation. Apply GitLab 19.2.8, 19.3.5 or 19.4.2.
What happened
CVE-2026-97229 is an integer overflow or wraparound (CWE-190) in GitLab CE/EE. The weakness lies in how GitLab validates regular expressions supplied through CI/CD configuration. Under certain conditions, an unauthenticated attacker can submit a specially crafted regular expression that triggers the integer overflow and can execute arbitrary code on the GitLab server.
The CVSS 3.1 vector is network-based with low attack complexity, no privileges and no user interaction, with high confidentiality, integrity and availability impact and scope changed. CISA KEV, CISA SSVC and ENISA EUVD list exploitation as active. CISA added the entry to the Known Exploited Vulnerabilities Catalog on 29 October 2026, and ENISA records exploitation since 29 October 2026.
Who is affected
Affected releases are GitLab CE/EE 19.2 to before 19.2.8, 19.3 to before 19.3.5, and 19.4 to before 19.4.2. These are self-managed source code management and CI/CD deployments. Instances that are reachable from untrusted networks are the most exposed to this unauthenticated attack.
What to do now
- Apply the fixed release for your installed branch immediately: GitLab 19.2.8 for 19.2, GitLab 19.3.5 for 19.3, and GitLab 19.4.2 for 19.4. Active exploitation is recorded, so this is the priority.
- If patching cannot be completed at once, restrict network access to the GitLab server so untrusted networks cannot reach it, and review CI/CD configuration submissions for unexpected or unusually complex regular expressions.
- Check the GitLab server for processes that should not be present and review access logs for unexpected requests.
GitLab has not published a separate workaround.
How to detect it
No vendor indicators of compromise are listed. Given unauthenticated network reach and active exploitation, focus on the GitLab server itself: unexpected process execution, and CI/CD configurations containing regular expressions that your teams did not author. Review internet-facing GitLab access for unusual requests.
Beyond the patch
An unauthenticated, network-reachable code-execution flaw in a source control and CI/CD platform is a serious exposure problem, and both CISA and ENISA record active exploitation. Organisations that run internet-facing GitLab should map and close that exposure through Virtual CISO Services (vCISO). For detection and response around possible exploitation, Managed Detection & Response (MDR) is the right service. If you suspect an incident, put the incident response retainer in place before you need it.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| GitLab | 19.2 – < 19.2.8 19.3 – < 19.3.5 19.4 – < 19.4.2 | 19.2.8 19.3.5 19.4.2 12-38.azl4 -0 |