CVE-2026-97229: GitLab CI/CD regular expression integer overflow allows unauthenticated RCE

Exploited in the wild Critical 10.0 EPSS 27.7% GitLab CE/EE

An integer overflow in the Onigmo regular-expression compiler in the Ruby that GitLab CE/EE ships lets an unauthenticated attacker run code on the GitLab server by submitting a specially crafted regular expression in a CI/CD configuration; it bypasses the incomplete fix for CVE-2026-93577 in GitLab 19.4.1. GitLab fixed it in 19.4.2, 19.3.5 and 19.2.8 on October 12, 2026, and the underlying Ruby bug is fixed in Ruby 4.0.8, 3.4.12 and 3.3.13, so other Ruby applications that compile attacker-controlled regular expressions may also be exposed. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-10-29 as exploited in the wild.

• CVE-2026-97229CVE identifier
• 10.0CVSS 3.1 base score (critical)
• 2026-10-29added to CISA's exploited list (US federal deadline 2026-11-01)
• 27.7%EPSS: chance of exploitation in the next 30 days (higher than 98% of CVEs)
• 2026-10-13published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• GitLab CE/EE 19.2 before 19.2.8
• GitLab CE/EE 19.3 before 19.3.5
• GitLab CE/EE 19.4 before 19.4.2 (including 19.4.1, which has the incomplete CVE-2026-93577 fix)

Fixed in:

• GitLab 19.4.2
• GitLab 19.3.5
• GitLab 19.2.8

Am I affected?

sudo gitlab-rake gitlab:env:info
dpkg -l gitlab-ee gitlab-ce 2>/dev/null | grep ^ii
rpm -q gitlab-ee gitlab-ce

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update && sudo apt install gitlab-ee=19.4.2-ee.0
# other series: 19.3.x -> 19.3.5, 19.2.x -> 19.2.8
# Community Edition: sudo apt update && sudo apt install gitlab-ce=19.4.2-ce.0

sudo apt update && sudo apt install gitlab-ee=19.4.2-ee.0
# other series: 19.3.x -> 19.3.5, 19.2.x -> 19.2.8
# Community Edition: sudo apt update && sudo apt install gitlab-ce=19.4.2-ce.0

# RHEL/AlmaLinux/Oracle Linux 9 (use .el8 on EL8)
sudo dnf install gitlab-ee-19.4.2-ee.0.el9
# other series: 19.3.x -> 19.3.5, 19.2.x -> 19.2.8
# Community Edition: sudo dnf install gitlab-ce-19.4.2-ce.0.el9

not packaged

# openSUSE Leap 15.5
sudo zypper install gitlab-ee=19.4.2-ee.sles15
# SLES 12
sudo zypper install gitlab-ee=19.4.2-ee.0.sles12
# other series: 19.3.x -> 19.3.5, 19.2.x -> 19.2.8; Community Edition: gitlab-ce=<version>-ce.sles15 (SLES 12: -ce.0.sles12)

# Amazon Linux 2023
sudo dnf install gitlab-ee-19.4.2-ee.0.amazon2023
# Amazon Linux 2
sudo yum install gitlab-ee-19.4.2-ee.0.amazon2
# other series: 19.3.x -> 19.3.5, 19.2.x -> 19.2.8; Community Edition: gitlab-ce-<version>-ce.0.<suffix>

sudo pacman -Syu

apk update && apk upgrade gitlab-runner (runner only)

pkg update && pkg upgrade gitlab-ce

# in docker-compose.yml set: image: gitlab/gitlab-ee:19.4.2-ee.0  (other series: 19.3.x -> 19.3.5, 19.2.x -> 19.2.8; CE: gitlab/gitlab-ce:<version>-ce.0)
docker compose pull
docker compose up -d

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

Look for signs of exploitation

• Workhorse access log (GitLab's highest-confidence signal): a 502 with error 'badgateway: failed to receive response: EOF' for POST /api/v4/projects/:id/ci/lint or POST /api/graphql, often with a large (~2 MB) request body; the crashing request is missing from api_json.log and graphql_json.log.
• application_json.log: WARN entries from Gitlab::Ci::Build::Rules::Rule::Clause::RegexpMatcher such as 'regexp rejected at compile time', 'rules:exists regexp match timed out' or 'regexp total time budget exceeded'; the offending pattern is logged in extra.regexp.
• graphql_json.log: ciLint requests whose variables contain comment-split counted repeats like {96(?#x)000,}, huge counted repeats like {96000,}, \g<...> subroutine calls or \K.
• api_json.log / production_json.log: request paths with a final segment of about 255 bytes that contains a percent-encoded non-ASCII byte (e.g. %C3); the proof of concept commits such a path to trigger the bypass.
• Native Ruby '[BUG]' crash reports with Onigmo frames (onig_compile, compile_tree, compile_length_tree) and regexp_matcher.rb in /var/log/gitlab/puma/puma_stderr.log, or Sidekiq worker crashes in /var/log/gitlab/sidekiq/current.
• api_json.log: bursts of POST /api/v4/projects/:id/ci/lint returning 5xx from scripted clients (python-requests, python-urllib, curl, Wget, no user agent).

Related vulnerabilities

• CVE-2026-93577
• CVE-2026-89078
• CVE-2026-110264

Sources

• GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8
• GitLab TLDR detection: Workhorse 502 on ci/lint and GraphQL
• GitLab TLDR detection: CI regexp guard rejection
• GitLab TLDR detection: hostile regexp in GraphQL ciLint
• GitLab TLDR detection: oversized non-ASCII path
• GitLab TLDR detection: Onigmo native worker crash
• GitLab TLDR detection: CI lint scripted-client error burst
• Ruby: Regexp compilation fixes related to GitLab's CVEs (Ruby 4.0.9, 3.4.12, 3.3.13)
• GitLab Docs: Upgrade a Linux package instance
• GitLab Docs: Install GitLab in a Docker container (image tags)
• GitLab Docs: Maintenance Rake tasks (gitlab:env:info, gitlab:check)
• CVE.org record CVE-2026-97229
• NVD: CVE-2026-97229
• CISA Known Exploited Vulnerabilities catalog (JSON feed)
• https://gitlab.com/gitlab-org/gitlab/-/work_items/630686
• https://hackerone.com/reports/4055749
• https://hackerone.com/reports/4058589
• CVE-2026-97229 on CVE.org
• CVE-2026-97229 on NVD
• CISA Known Exploited Vulnerabilities catalog

Page generated automatically from official sources on 2026-11-03 17:06 UTC and reviewed by an editor. Always confirm with your vendor's advisory.