GitLab CI/CD regular expression flaw: the CISA KEV entry, fixed versions and what to check first
GitLab fixed a flaw in Community Edition and Enterprise Edition that could let an unauthenticated user run code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. CISA lists it as exploited and marks forensic triage as required. Each statement below links to its official source, with the quoted text one click away. This page gives no commands to run.
Facts last checked against the stored sources on
What happened
-
CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on , listing it under the name GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability. The catalog lists as the due date.
Source: CISA Known Exploited Vulnerabilities catalog
Quoted text
"cveID": "CVE-2026-97229", "vendorProject": "GitLab", "product": "Community Edition and Enterprise Edition", "vulnerabilityName": "GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability", "dateAdded": "2026-10-29",
"dueDate": "2026-11-01",
-
The catalog entry marks forensic triage as required. Its required action refers to CISA's Forensics Triage Requirements.
Source: CISA Known Exploited Vulnerabilities catalog
Quoted text
"forensicTriage": "Yes",
ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).
-
The catalog describes the flaw as one that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration.
Source: CISA Known Exploited Vulnerabilities catalog
Quoted text
could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
-
GitLab's patch release notes describe CVE-2026-97229 as an integer overflow issue in the CI/CD regular expression compiler. GitLab says that under certain conditions an unauthenticated user could execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, and rates it CVSS 10.0.
Source: GitLab patch release notes
Quoted text
CVE-2026-97229 - Integer Overflow issue in CI/CD Regular Expression Compiler impacts GitLab CE/EE
GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
CVSS 10.0 ( CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H )
Affected and fixed GitLab versions
These are the versions GitLab lists for GitLab Community Edition (CE) and Enterprise Edition (EE). Vendors and products that are not listed here are not covered by this page.
-
GitLab lists the affected CE and EE versions as all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.
Source: GitLab patch release notes
Quoted text
Impacted Versions: GitLab CE/EE: all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2
-
GitLab released 19.4.2, 19.3.5 and 19.2.8 for CE and EE on . It says it strongly recommends that all self-managed installations be upgraded to one of these versions immediately.
Source: GitLab patch release notes
Quoted text
On October 12, 2026, we released versions 19.4.2, 19.3.5, 19.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).
we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately.
-
GitLab says its own managed infrastructure, including GitLab.com and GitLab Dedicated, remains patched. The affected-version list therefore matters for self-managed installations.
Source: GitLab patch release notes
Quoted text
GitLab-managed infrastructure, including GitLab.com and GitLab Dedicated, remains patched.
-
GitLab warns that this patch release includes database migrations. On single-node instances the upgrade causes downtime, because the migrations must complete before GitLab can start. On multi-node instances, with proper zero-downtime upgrade procedures, the patch can be applied without downtime.
Source: GitLab patch release notes
Quoted text
This patch includes database migrations that may impact your upgrade process.
Single-node instances : This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
Multi-node instances : With proper zero-downtime upgrade procedures , this patch can be applied without downtime.
Where the flaw comes from
-
The Ruby project says it released fixes for bugs in Ruby's regular expression engine, Onigmo, which GitLab found could be used for remote code execution on GitLab servers.
Source: Ruby project news
Quoted text
They fix several bugs in Ruby’s regular expression engine (Onigmo) that GitLab found could be used for remote code execution on GitLab servers.
-
According to the Ruby project, GitLab compiles regular expressions supplied by its users, such as patterns in CI configuration. It found that specially crafted patterns could corrupt memory while Ruby compiles them.
Source: Ruby project news
Quoted text
GitLab compiles regular expressions supplied by its users, such as patterns in CI configuration, with Regexp.new .
GitLab found that specially crafted patterns could corrupt memory while Ruby compiles them
-
The Ruby project says GitLab addressed these issues in its own releases by patching the Ruby it ships. It lists CVE-2026-97229 as an integer overflow issue in the CI/CD regular expression compiler, addressed in GitLab 19.4.2.
Source: Ruby project news
Quoted text
GitLab addressed these issues in its own releases by patching the Ruby it ships
CVE-2026-97229 : Integer Overflow issue in CI/CD Regular Expression Compiler ( GitLab 19.4.2 )
-
The Ruby project released 4.0.9, 3.4.12 and 3.3.13, and says they contain the fixes for the underlying bugs in Ruby.
Source: Ruby project news
Quoted text
We have released Ruby 4.0.9, 3.4.12 and 3.3.13.
the Ruby releases contain the fixes for the underlying bugs in Ruby.
-
The Ruby project says these bugs are reached only when an application compiles a regular expression from a string that an attacker controls. Applications that only use regular expressions written by their own developers are not affected.
Source: Ruby project news
Quoted text
These bugs are reached only when an application compiles a regular expression from a string that an attacker controls
Applications that only use regular expressions written by their own developers are not affected.
-
CISA's catalog entry adds that other products can potentially be affected by the same underlying Ruby and Onigmo integer overflow issue. This page does not cover products other than GitLab.
Source: CISA Known Exploited Vulnerabilities catalog
Quoted text
Other products can potentially be affected by the same underlying Ruby/Onigmo Integer Overflow issue in CI/CD Regular Expression Compiler.
Check whether an instance is already compromised before you patch
This page gives no commands: GitLab's notes list detections rather than a command to run. Finding nothing does not prove an instance is clean. CISA's guidance is to collect evidence first and to patch after that, because patching or restarting can destroy it.
-
CISA's forensic triage guidance says not to alter or remediate systems before evidence is collected when possible, and to begin evidence analysis to determine whether a compromise occurred.
Source: CISA (BOD 26-04 implementation guidance)
Quoted text
Do not alter or remediate systems prior to evidence/artifact collection when possible.
Begin evidence analysis to determine if a compromise occurred.
-
The same guidance warns that containment started too early can destroy vital evidence, and says to isolate impacted and suspected impacted systems.
Source: CISA (BOD 26-04 implementation guidance)
Quoted text
Premature containment can destroy vital evidence.
Isolate impacted and suspected impacted systems and network infrastructure.
-
GitLab says it has released six threat detections to support customers with self-managed instances. They are named: Onigmo native worker crash, Graphql cilint hostile regexp, ci regexp oversized non ascii path, ci regexp guard rejection, ci lint workhorse worker crash and ci lint scripted client error burst. The names link to GitLab's own detection pages in its release notes.
Source: GitLab patch release notes
Quoted text
GitLab security has released six threat detections to support customers with self-managed instances, listed below.
Onigmo native worker crash Graphql cilint hostile regexp ci regexp oversized non ascii path ci regexp guard rejection ci lint workhorse worker crash ci lint scripted client error burst
- List the self-managed GitLab CE and EE instances you run, and note the version of each. Compare each with the affected and fixed versions above. GitLab.com and GitLab Dedicated are patched by GitLab.
- For an instance in the affected range, collect evidence before you patch or restart: copy its logs and any monitoring data to a place off the host. A restart discards memory and anything that lived only in it.
- Review the six GitLab detections listed above against your own logs and monitoring, using GitLab's detection pages. GitLab describes them as detections for exploitation attempts; they do not prove an instance is clean.
- If anything is unexplained, isolate the instance and escalate it as an incident instead of deleting files. Rebuild from a known-good source once the evidence is kept.
- Then upgrade to a fixed version from the table above. Plan for downtime on a single-node instance, because the migrations must complete before GitLab can start.