GitLab says that under certain conditions an unauthenticated user could run arbitrary code on the server through a crafted regular expression in a CI/CD configuration. It is rated CVSS 10.0 and was fixed in 19.4.2, 19.3.5 and 19.2.8 on 12 October 2026.
What it allows
GitLab says an unauthenticated user could execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, because of insufficient regular expression validation. The CVSS vector is network, low complexity, no privileges, no user interaction and a changed scope.
Rapid7 reproduced code execution on the official GitLab 19.4.1 CE image with address space layout randomization on, and saw no execution on the patched 19.4.2 image. In its description, a regular expression first compiles in a compact US-ASCII form and passes GitLab's validation. It is then recompiled for UTF-8 when matched against a specially formed repository path, and an integer overflow in the compiler's program-size calculation produces invalid instructions. The command runs as the GitLab git user.
Rapid7 notes that its route needs the attacker to place a malicious CI/CD configuration and a specially named path in a public project first. On instances where new users can register and create projects, that step is easy. Rapid7 says this conflicts with the "no privileges" rating and that it does not know how the private report avoids it.
In Brandefense's dark web and Telegram monitoring, we found 23 posts naming this CVE between 12 and 22 October 2026. Seventeen repeat advisories or news and six point to public proof-of-concept repositories or report on them. GitHub search metadata showed three repositories claiming a proof of concept. Treat unverified repositories with care; we did not open or run any code.
Ruby's announcement of 23 October names this CVE among four GitLab CVEs that rely on bugs in Ruby's regular expression engine. It ties CVE-2026-97229, together with CVE-2026-93577, to an integer overflow in the size of a compiled pattern. The fix is in Ruby 4.0.8, 3.4.12 and 3.3.13.
Alpine Linux reported an exploitation attempt against its own GitLab on 20 and 21 October 2026. A newly registered account sent crafted CI configurations to the instance, which still ran 19.3.4, and crashed worker processes 8 times. Alpine says: "We have found no evidence that it succeeded, but we cannot rule it out." It rebuilt the instance and says its releases and packages were not modified.
Who is affected
GitLab CE and EE, all deployment types: all versions from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. Fixed in 19.2.8, 19.3.5 and 19.4.2. GitLab.com was already patched and Dedicated tenants did not need to act.
These fixed versions are not the end of the story. CVE-2026-110264, fixed by GitLab on 21 October 2026, affects 19.2.8, 19.3.5 and 19.4.2 as well. Move to 19.2.9, 19.3.6, 19.4.3 or 19.5.1.
Timeline
- 12 Oct 2026
GitLab releases 19.4.2, 19.3.5 and 19.2.8 and lists six threat detections for self-managed customers.
- 13 Oct 2026
The NVD record is published. Rapid7 publishes its alert, links a proof-of-concept repository and reports no confirmed exploitation in the wild.
- 14 Oct 2026
The CISA coordinator entry on the NVD record marks exploitation as "none", automatable as "yes" and technical impact as "total".
- 16 Oct 2026
Rapid7 publishes a technical analysis of one exploit route.
- 20–21 Oct 2026
A newly registered account sends crafted CI configurations to Alpine Linux's GitLab, still on 19.3.4 without the fix, and crashes its worker processes 8 times. Alpine later reports no evidence that the attack succeeded. The attacker returns on 25 and 26 October, and those attempts fail.
- 21 Oct 2026
GitLab ships a further critical fix, CVE-2026-110264, in 19.4.3, 19.3.6, 19.2.9 and newer. The 12 October versions are affected by it.
- 23 Oct 2026
The Ruby project releases 4.0.9, 3.4.12 and 3.3.13, which carry the fix for the Ruby bug behind this CVE.
- 28 Oct 2026
Alpine Linux publishes its incident note. It rebuilt the instance from scratch and reset all passwords, and says its releases and packages were not modified. Its earlier upgrade to 19.3.6 had not fixed the flaw, because its image used standard Ruby.
- 29 Oct 2026
CISA adds CVE-2026-97229 to the Known Exploited Vulnerabilities catalog.
What to do
-
Check your version
Open Help in the left sidebar and read the version. If it is below 19.2.8, 19.3.5 or 19.4.2 on those branches, you are exposed to this flaw.
-
Skip ahead to the newer patch
Do not stop at 19.4.2 or 19.3.5. Go to 19.5.1, 19.4.3, 19.3.6 or 19.2.9 so that CVE-2026-110264 is fixed too. If you run GitLab with your own Ruby rather than GitLab's packages, Alpine Linux warns that upgrading GitLab is not enough. Then you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later.
-
Limit public project exposure if you must wait
Rapid7 said restricting anonymous access to public projects and stopping untrusted users from creating or writing to public projects can reduce exposure to the route it showed. It does not fix the flaw.
-
Review logs
Rapid7 suggests looking in the Workhorse log for long CI lint API requests that end in HTTP 502, and for Puma worker crashes that mention regexp_matcher.rb. GitLab also lists six detections.
What Brandefense can do
- Check CVE-2026-97229 in Brandefense Atlas, free
See the current status of CVE-2026-97229 in Brandefense Atlas, with the sources behind it.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-97229?
It is a critical integer overflow in the GitLab CI/CD regular expression compiler. GitLab says it could let an unauthenticated user run code on the server. It is rated CVSS 10.0.
Which versions fix CVE-2026-97229?
GitLab 19.2.8, 19.3.5 and 19.4.2 fixed it on 12 October 2026. Versions before 19.2 are not listed as affected by this CVE.
Is 19.4.2 still safe to run?
Not fully. CVE-2026-110264, fixed on 21 October 2026, affects 19.4.2, 19.3.5 and 19.2.8. Upgrade to 19.4.3, 19.3.6, 19.2.9 or 19.5.1.
Is there a public proof of concept?
Rapid7 published one and links it from its alert. We also saw other repositories claiming the same, which we could not verify. Do not run code you have not read.
Sources
- GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8GitLab
- CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLabRapid7
- Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)Rapid7
- CVE-2026-97229NVD
- CVE-2026-97229CVE Program
- Known Exploited Vulnerabilities catalogCISA
- GitLab security incident: attempted exploitation of CVE-2026-97229Alpine Linux
- GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13GitLab
