GitLab Patches Critical CVE-2026-97229 RCE Flaw

GitLab last Thursday released emergency updates for its self-managed Community and Enterprise editions to fix a maximum-severity vulnerability that lets an unauthenticated attacker run arbitrary code on the server.

The flaw is tracked as CVE-2026-97229 and carries a CVSS score of 10.0. GitLab describes it as an integer overflow in the CI/CD regular expression compiler. It affects every release from 19.1 onward and is fixed in versions 19.4.2, 19.3.4 and 19.2.8, published on October 8.

According to GitLab’s advisory, an attacker can trigger the bug with a specially crafted regular expression placed in a CI/CD configuration, because GitLab does not validate those expressions well enough. The CVSS vector rates the attack as network-based and low in complexity, with no privileges and no user interaction required. It also marks the scope as changed, meaning a successful attack reaches beyond the vulnerable component itself.

GitLab’s advisory does not explain how an attacker without an account gets a pipeline configuration processed. It also does not name the underlying component. The same release, however, adds two patches to the Ruby interpreter that ships in GitLab’s Omnibus packages and cloud-native images: a “regexp program size” fix and a separate fix for a double-free in regexp repeat ranges. Both are applied to Ruby 3.3 and 3.4.

The program-size patch comes from a Ruby pull request merged on September 25 by core developer Hiroshi Shibata. It fixes overflows in Onigmo, Ruby’s regular expression engine. A nested bounded repeat, such as (?:.{90000,}){90000} overflows the multiplication the compiler uses to decide whether a repeat is small enough to unroll inline. The oversized repeat then passes that check, so the compiler expands an enormous program and hangs.

A second path is more serious. A pattern like .{100000,} turns about ten bytes of source into roughly 100,000 compiled instructions. A few hundred kilobytes of such repeats strung together pushes the compiled program past the largest value a signed 32-bit integer can hold. The jump offsets are written into the program, then wrap around. The fix rejects any compiled program too large for its offset type, checking the size as instructions are emitted rather than trusting the earlier length calculation, which overflows along with it.

GitLab credits a researcher known as joaxcar with reporting CVE-2026-97229 through its HackerOne bug bounty program. The same researcher also reported CVE-2026-7767, an open redirect in GitLab’s Kubernetes proxy that could send authentication tokens to an unintended server.

The October 8 release was an ad-hoc critical patch, not one of GitLab’s scheduled patch releases on the second and fourth Wednesdays of the month. It fixes 24 vulnerabilities in total: one critical, five high-severity, 14 medium and four low.

The high-severity issues include a stored cross-site scripting flaw in syntax highlighting (CVE-2026-92883, CVSS 8.7). Another lets Developer-role users run pipelines on protected branches through the downstream pipeline service (CVE-2026-16301, CVSS 8.5). A third is a cache-poisoning bug in raw repository file access that could make other users’ pipelines run attacker content and expose protected variables (CVE-2026-14814, CVSS 8.2). Three medium-severity GraphQL authorization bugs let unauthenticated users read confidential notes or private work item contents.

GitLab said self-managed installations should be upgraded “immediately.” GitLab.com already runs the patched code, and GitLab Dedicated customers need not take action. The update includes database migrations, so single-node instances will be down while migrations complete. Multi-node deployments can apply it without downtime using GitLab’s zero-downtime procedure.

GitLab has not reported in-the-wild exploitation of CVE-2026-97229. Following its usual policy, the company will publish the issue tracker entries for these vulnerabilities 90 days after the patch release.