Critical CVE-2026-97229 in GitLab CE and EE, CVSS 10.0. Affected versions, fixed releases, the CISA deadline and what to do now.
GitLab sits at the center of the CI/CD pipelines where code is stored, built and shipped. That makes a flaw in it weigh more than a flaw in a typical web app. CVE-2026-97229 is that kind of flaw: under certain conditions, an unauthenticated attacker could run code on the GitLab server.
Short answer: CVE-2026-97229 in GitLab Community Edition and Enterprise Edition is rated critical, with a CVSS score of 10.0. Under certain conditions, an unauthenticated attacker who places a crafted regular expression in a CI/CD configuration could execute code on the server. The fixed versions are 19.2.8, 19.3.5 and 19.4.2. No verified workaround is documented, so the recommended step is to upgrade. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on October 29, 2026.
What happened?
The root cause is in the regular expression engine Onigmo, which Ruby uses. GitLab compiles user-supplied regular expressions from CI/CD configuration with it. The flaw is an integer overflow: a number grows past the largest value the program can store and wraps around, so the memory calculations that follow go wrong. Such bugs can corrupt memory, and GitLab says this can be turned into code execution. The weakness is classified as CWE-190.
GitLab found the issue, reported it to the Ruby team and coordinated the fix. GitLab also patched the Ruby it ships, which resolved the problem in its own releases. The Ruby team has not yet requested a CVE for these fixes, so tracking uses GitLab’s CVE numbers.
The flaw entered NVD on October 13, 2026, 24 days before this post. The flaw is old, but evidence of its use in attacks is recent: CISA added it to KEV on October 29, 2026, with a remediation deadline of November 1, 2026.
Who is affected?
| Attribute | Details |
|---|---|
| CVE ID | CVE-2026-97229 |
| Product | GitLab Community Edition (CE) and Enterprise Edition (EE) |
| Affected versions | 19.2 before 19.2.8; 19.3 before 19.3.5; 19.4 before 19.4.2 |
| Fixed versions | 19.2.8, 19.3.5, 19.4.2 |
| CVSS score | 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) |
| Severity | Critical |
| Weakness type | CWE-190 (Integer Overflow or Wraparound) |
| NVD publication date | October 13, 2026 |
| Added to CISA KEV | October 29, 2026 |
| CISA due date | November 1, 2026 |
| Known ransomware use | Unknown (KEV lists “Unknown”) |
If you use GitLab.com, the platform’s servers already run patched versions. GitLab Dedicated tenants were also patched with an internal build before the public patch release. The real responsibility sits with teams that run GitLab on their own servers.
What should you do?
- Check your version. On an Omnibus installation,
sudo gitlab-rake gitlab:env:infoprints the GitLab version. The version shown in the admin area works too. - Check whether you fall in the affected range. If you run anything older than 19.2.8, 19.3.5 or 19.4.2 on the matching branch, the flaw affects your server.
- Upgrade now. Move to the fixed release using your installation method (Omnibus package, Docker image or Helm chart). Follow GitLab’s upgrade documentation for your method, because the steps differ.
- Do not rely on a workaround. The patch page documents no verified workaround. If you cannot upgrade right away, restrict access to GitLab with a VPN or IP allowlist. This buys time; it does not fix the flaw.
- Apply the detection rules. GitLab published six detection rules for self-managed installations. Load them into your log pipeline.
- If in doubt, investigate. Review recent CI/CD configuration changes and GitLab logs. CISA’s KEV entry notes forensic triage requirements; it is worth doing this with someone experienced in incident response.
Frequently asked questions
Does this affect me?
Yes, if you run GitLab CE or EE on your own server and your version is in the affected range above. If you use GitLab.com, the platform side is patched, but check your own version information anyway.
The CVSS score is 10.0. Is it really that important?
Yes. The score is at the top of the scale, and the flaw is on CISA’s list of exploited vulnerabilities. Checking your version today is better than putting it off.
What if I cannot update immediately?
No verified workaround is documented. Remove direct internet exposure of your GitLab instance, restrict access and schedule the upgrade with a firm date. the due date CISA set in its KEV entry was November 1, 2026.
Sources
- NVD record: CVE-2026-97229
- CISA Known Exploited Vulnerabilities catalog
- GitLab critical patch release: 19.4.2, 19.3.5, 19.2.8
- Ruby news: regexp fixes for GitLab CVEs
This post was prepared on November 6, 2026 from CISA and NVD records; it will be updated if new information appears. For server updates and security maintenance, you can reach me through the quote form.