Background
GitLab CE/EE is a widely self-hosted source-control and CI/CD platform. A GitLab server holds source code, pipeline definitions and, typically, deployment credentials, so code execution on it is a supply-chain-grade foothold.
CVE-2026-97229 is tracked by GitLab as “Integer Overflow in CI/CD Regular Expression Compiler”. GitLab’s CNA record says that under certain conditions an unauthenticated user could have been able to execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, because of insufficient regular expression validation. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-29 with a due date of 2026-11-01.
Technical Mechanism
The weakness is classified as CWE-190 (integer overflow or wraparound). Per the Ruby project’s advisory of 23 October 2026, the underlying defects are in Onigmo, the regex engine Ruby uses. CVE-2026-97229 and a sibling GitLab CVE, CVE-2026-93577, share Ruby change #19020, an integer overflow in the compiled pattern size, fixed in Ruby 4.0.8, 3.4.12 and 3.3.13.
Our reading of the sources: a regex supplied in CI/CD configuration is compiled by the server; a crafted pattern overflows a size calculation in the compiler and corrupts memory. The public sources we opened do not publish an exploit chain, so the exact corruption primitive is not described here. Open question: the CNA text says unauthenticated, yet the sibling CVE-2026-93577 (the same Ruby bug, #19020) is rated by GitLab as requiring authentication (PR:L, 9.9). The sources we read do not explain how an unauthenticated party supplies CI/CD configuration.
The Ruby advisory states that only applications that compile attacker-controlled regular expressions are affected, and that Regexp.timeout and limiting pattern length do not reliably protect.
GitLab’s CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0). That score comes from GitLab as the CNA (secondary source). As of 2026-10-30 NVD’s status is “Undergoing Analysis” and shows no NVD-primary score.
Real-World Exploitation Evidence
- CISA KEV: added 2026-10-29, due date 2026-11-01. The entry carries the
forensicTriageflag (value Yes) and lists known ransomware campaign use as Unknown. - CISA-ADP SSVC (in NVD, dated 2026-10-13, 16 days before the KEV listing): exploitation “active”, automatable “yes”, technical impact “total”.
- Threat actors: no evidence found as of 2026-10-30 in KEV, NVD, the GitLab patch release notes or the Ruby advisory of any named actor or campaign. We do not know who is exploiting it.
- Related CVEs: The Ruby advisory (not the GitLab 19.4.2 notes) groups four regex-related GitLab CVEs. Per NVD records (all CVSS from GitLab as CNA, secondary):
| CVE | Type | Access per NVD | CVSS | Fixed in |
|---|---|---|---|---|
| CVE-2026-89078 | double free | authenticated | 9.9 | 19.4.1, 19.3.3, 19.2.7 |
| CVE-2026-93577 | integer overflow | authenticated | 9.9 | 19.4.1, 19.3.3, 19.2.7 |
| CVE-2026-97229 | integer overflow | unauthenticated | 10.0 | 19.4.2, 19.3.5, 19.2.8 |
| CVE-2026-110264 | integer overflow | unauthenticated | 10.0 | 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 |
CVE-2026-110264 (GitLab release of 2026-10-21) is rated by GitLab as an unauthenticated CVSS 10.0 code-execution flaw affecting versions from 7.0. Its CISA-ADP SSVC entry (2026-10-21) shows exploitation none, automatable yes. As of the KEV snapshot we read (feed released 2026-10-29), none of the other three CVEs is listed in KEV. Fixed in 19.4.2 does not mean fixed for CVE-2026-110264.
- Other products: the KEV notes say other products may be affected by the same Ruby/Onigmo issue.
Impact Assessment
If the CNA description holds, an unauthenticated attacker with network access to a vulnerable instance achieves code execution as the GitLab application. Our assessment of consequences, not sourced from a vendor statement: access to repositories, CI/CD variables and runner registration tokens, and a path to poison pipelines that deploy to production.
GitLab.com and GitLab Dedicated were already patched according to GitLab, so exposure is concentrated in self-managed instances, especially internet-facing ones.
Affected Versions
| Branch | Affected | Fixed |
|---|---|---|
| 19.2 | 19.2.0 up to but excluding 19.2.8 | 19.2.8 |
| 19.3 | 19.3.0 up to but excluding 19.3.5 | 19.3.5 |
| 19.4 | 19.4.0 up to but excluding 19.4.2 | 19.4.2 |
The table is the range for CVE-2026-97229 as stated by NVD and GitLab (critical patch release of 2026-10-12). Branches older than 19.2 are outside this CVE’s range, but CVE-2026-110264 reaches back to GitLab 7.0 (fixed in 18.11.13, 19.0.10, 19.1.9 and the versions above).
Remediation Steps
- Upgrade self-managed GitLab to the latest patch of your branch, and at least 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. Those 2026-10-21 releases also fix CVE-2026-110264; 19.4.2, 19.3.5 and 19.2.8 alone leave it open.
- CISA’s due date for federal agencies is 2026-11-01; treat it as the target for everyone.
- Because the KEV entry is flagged for forensic triage, review the instance for compromise before and after patching (see Detection Guidance). Patching does not remove an existing foothold.
- Rotate CI/CD variables, runner tokens and deploy keys if compromise cannot be ruled out. This is our recommendation.
- Where you cannot upgrade, the Ruby advisory’s guidance is to avoid compiling untrusted patterns. No workaround found as of 2026-10-30 in the GitLab 19.4.2 notes, the NVD record or the Ruby advisory.
- Applications outside GitLab that compile untrusted regexes should move to Ruby 4.0.9, 3.4.12 or 3.3.13 per the Ruby advisory.
Detection Guidance
GitLab’s 19.4.2 notes say it has released six threat detections for self-managed instances (the notes give no date): Onigmo native worker crash, GraphQL CI lint hostile regexp, CI regexp oversized non-ASCII path, CI regexp guard rejection, CI lint Workhorse worker crash, and CI lint scripted client error burst. Enable them. Our suggestion: review hits back to at least 2026-10-12, the patch date (GitLab gives no lookback period).
Our suggestions, not from the vendor: look for repeated crashes or restarts of Puma/Sidekiq workers, CI lint API calls from unauthenticated or unfamiliar sources, unusual child processes of the GitLab application user, and new runners, tokens or CI variables you did not create.
Timeline
| Date | Event |
|---|---|
| 2026-10-12 | GitLab critical patch release 19.4.2, 19.3.5, 19.2.8 |
| 2026-10-13 | CVE published in NVD; CISA-ADP SSVC entry shows active exploitation |
| 2026-10-23 | Ruby publishes advisory on the Onigmo fixes |
| 2026-10-29 | CISA adds CVE-2026-97229 to KEV |
| 2026-11-01 | CISA due date |