GitLab Under Threat: Maximum-Severity RCE Vulnerability in Regex Compiler Engine

Summary

GitLab has released security updates to address CVE-2026-97229, a critical integer overflow vulnerability in the CI/CD Regular Expression Compiler affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability carries a maximum CVSS score of 10.0 and could allow an unauthenticated remote attacker to execute arbitrary code on a vulnerable GitLab server under certain conditions. The flaw arises from insufficient validation of specially crafted regular expressions in CI/CD configuration files, potentially exposing the underlying server to compromise. GitLab has addressed the issue in versions 19.2.8, 19.3.5, and 19.4.2. Administrators running affected self-managed installations should prioritize upgrading to a fixed release.

Vulnerability Details

CVE ID	Severity	CVSS Score	Vulnerability Type
CVE-2026-97229	Critical	10.0	Integer Overflow or Wraparound

Technical Detail

The root cause of CVE-2026-97229 is an integer overflow vulnerability in GitLab's CI/CD Regular Expression Compiler, which processes regular expressions used in CI/CD pipeline configuration files. The vulnerability results from insufficient validation of regular expressions under certain conditions. A specially crafted regular expression can trigger the integer overflow during processing, potentially causing the compiler to handle the input incorrectly and creating a path to arbitrary code execution on the GitLab server. GitLab has rated this vulnerability CVSS 10.0 (Critical) because successful exploitation could have severe consequences for the confidentiality, integrity, and availability of the affected system.

The vulnerability could be exploited remotely by an unauthenticated attacker under the conditions described in GitLab's advisory. By supplying a specially crafted regular expression through a CI/CD configuration, an attacker could trigger the vulnerable compiler functionality without first obtaining valid credentials or requiring a victim to interact with the malicious input. Successful exploitation could allow arbitrary code execution on the affected GitLab server. The vulnerability affects GitLab Community Edition (CE) and Enterprise Edition (EE) within the specified vulnerable release ranges.

Successful remote code execution could compromise the GitLab instance and expose resources accessible to the GitLab service. Depending on the privileges obtained and the deployment configuration, an attacker could potentially access source code, repository data, CI/CD variables, deployment credentials, and other sensitive information. Because GitLab is commonly integrated with build systems, deployment environments, and external infrastructure, a compromised instance could also create risks for connected development and software delivery workflows. The extent of any subsequent compromise would depend on the permissions of the compromised process, the secrets available to it, and the security controls protecting connected systems.

Affected Versions

According to the official GitLab security advisory, the following GitLab Community Edition (CE) and Enterprise Edition (EE) versions are affected:

Product	Affected Versions	Fixed Version
GitLab CE/EE 19.2	19.2.x before 19.2.8	19.2.8
GitLab CE/EE 19.3	19.3.x before 19.3.5	19.3.5
GitLab CE/EE 19.4	19.4.x before 19.4.2	19.4.2

GitLab addressed CVE-2026-97229 in the patched releases 19.2.8, 19.3.5, and 19.4.2. Organizations should identify affected self-managed installations and upgrade to a fixed version as soon as possible according to official GitLab security advisory . Administrators should also review relevant application, system, and CI/CD pipeline logs for suspicious activity if exploitation is suspected. The referenced advisory does not specify a unique log pattern or confirmed indicator of compromise for this vulnerability, so unusual regular expressions or pipeline activity should be treated as investigative leads rather than definitive evidence of exploitation.

Impact

Successful exploitation of CVE-2026-97229 could allow a remote unauthenticated attacker to execute arbitrary code on a vulnerable GitLab server, potentially compromising the instance and its accessible resources.

1. 1. Remote code execution on the affected GitLab server without authentication, under the conditions required for exploitation
2. 2. Unauthorized access to sensitive source code, repository data, CI/CD variables, and credentials accessible to the compromised service
3. 3. Unauthorized modification of GitLab files, repositories, or CI/CD pipelines, depending on the privileges obtained
4. 4. Disruption of GitLab services and software build or deployment workflows
5. 5. Potential compromise of connected development and deployment infrastructure through exposed credentials and secrets

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic ID	Tactic
T1190	Exploit Public-Facing Application	TA0001	Initial Access

Mitigation and Recommendations

• 1. Upgrade affected installations to the corresponding fixed release or a later supported version that includes the security fix.
• 2. Prioritize internet-facing GitLab instances because they may be reachable by remote attackers.
• 3. Review CI/CD configuration changes and investigate suspicious or unexpected regular expressions and pipeline activity where appropriate.
• 4. Review available GitLab application logs, system logs, and endpoint telemetry for signs of unauthorized activity. Treat these as general investigation measures, not as confirmed indicators specific to this CVE.
• 5. Review access to CI/CD variables, repository credentials, deployment tokens, and other secrets if compromise is suspected. Rotate potentially exposed credentials and tokens as appropriate.
• 6. Verify that the upgrade completed successfully and that the deployed GitLab version contains the relevant security fix.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.