CISA adds critical GitLab CI/CD regex flaw to its must-patch list
The integer overflow bug could let an unauthenticated user run code on a GitLab server through a crafted regular expression in a CI/CD configuration. GitLab has released fixes.
CISA added a critical GitLab vulnerability to its list of known exploited vulnerabilities on 29 October 2026, with a remediation deadline of 1 November 2026.
The flaw, tracked as CVE-2026-97229, is an integer overflow or wraparound issue in GitLab Community Edition and Enterprise Edition. According to the CISA entry, insufficient regular expression validation means a specially crafted regular expression in a CI/CD configuration could let an unauthenticated user execute arbitrary code on the GitLab server.
GitLab's own advisory says the company has remediated the issue. It affects versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab scored the bug 10.0 under CVSS 3.1, the maximum, with a network attack vector and no privileges or user interaction required.
CISA's notes say the same underlying Ruby/Onigmo integer overflow in the CI/CD regular expression compiler may affect other products, and point to a Ruby security announcement for details. The agency lists ransomware use as unknown.
What defenders should do
CISA's required action is to apply mitigations per vendor instructions, following its risk-based patching directive and forensics triage guidance. Organizations should treat internet-facing GitLab instances as the priority, and follow the directive's guidance for cloud services or stop using the product where mitigations aren't available.
The agency also says asset owners are responsible for judging each system's internet exposure. Given the unauthenticated attack path and maximum severity score, confirming which GitLab versions are running is the practical first step.
CVE references
Sources
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning