CVE-2026-97229
Integer Overflow or Wraparound in GitLab
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA notes
Other products can potentially be affected by the same underlying Ruby/Onigmo Integer Overflow issue in CI/CD Regular Expression Compiler. For more information please see: https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves ; https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-97229
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HKey Findings
as of 2026-11-01- CISA added CVE-2026-97229 to the KEV catalog 16 days after its CVE record was published. The median for entries added in 2026 so far is 14 days.
- It is one of 6 GitLab entries in the CISA KEV catalog, and one of 4 added in 2026.
- Its current EPSS score (27.3%) is higher than that of 38% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| GitLab | GitLab GitLab | 19.2 to <19.2.8 19.3 to <19.3.5 19.4 to <19.4.2 |
References
6 linksRecord Details
- Published
- 2026-10-13
- Last updated
- 2026-10-30
- Assigner (CNA)
- GitLab
- Credited to
- Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program
More from GitLab
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
Weak Password Recovery Mechanism for Forgotten Password in GitLab
GitLab Server-Side Request Forgery (SSRF) Vulnerability
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.