CVE-2026-97229: GitLab CI/CD Regexp Overflow Hits CISA KEV - Unauth RCE, Due 1 Nov

CVE-2026-97229 is an integer overflow (CWE-190) in GitLab CE/EE's CI/CD regular expression compiler. CISA added it to KEV on 29 October 2026. Federal due date 1 November 2026. Ransomware-campaign flag: Unknown. Forensic-triage flag: Yes. GitLab scores it CVSS 3.1 10.0 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). NVD status Undergoing Analysis - the 10.0 is GitLab's; NVD did not publish a primary score in the record we fetched. CISA Coordinator SSVC (timestamp 2026-10-29T19:50:05Z): exploitation: active, automatable: yes, technicalImpact: total. Catalog version we fetched: 2026.10.29, 1764 entries, dateReleased 2026-10-29T19:09:34.4003Z.[2][3][4]

GitLab shipped the patch on 12 October 2026: 19.4.2 / 19.3.5 / 19.2.8. CCCS updated AV26-1028 the day CISA listed it. The new fact is KEV + a three-day clock, not a missing vendor release.[4][6]

If you run self-managed GitLab on a VPS or a bare-metal box, this is the version floor and what to look at after you upgrade.

What it is

GitLab's advisory: an unauthenticated user can, under certain conditions, execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, because regular-expression validation was insufficient. Reporter credit: joaxcar, via HackerOne. Impacted versions named by GitLab: CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2. When GitLab does not name an install type, omnibus, source, and Helm are all in scope.[4]

Ruby published the engine-side story on 23 October 2026. GitLab compiles user-supplied patterns (CI configuration is the example they give) with Regexp.new. Crafted patterns could corrupt memory while Ruby compiles them, and GitLab turned that into RCE on the server. GitLab patched the Ruby it ships. The Ruby releases that contain the Onigmo fixes are 4.0.9, 3.4.12 and 3.3.13. Ruby maps CVE-2026-97229 and CVE-2026-93577 to the same integer-overflow in compiled-pattern size (#19020). A sibling ID, CVE-2026-110264, is a different overflow (internal IDs in a pattern with many repeats) patched in GitLab 19.5.1 on 21 October. Do not collapse those IDs.[5][7]

We did not reverse the compiler. The public facts stop at: integer overflow in the CI/CD regexp compiler, unauthenticated, code execution on the GitLab host.

How serious

CISA listing it on KEV means they have evidence of active exploitation. SSVC automatable: yes is CISA's label, not ours. GitLab's 10.0 is network, no privileges, no user interaction, scope changed, confidentiality/integrity/availability all High. That is as bad as a self-hosted GitLab CVE gets.[2][3][4]

The due date is 1 November. BOD 26-04 also asks whether someone used the hole before you closed it - this KEV row has forensicTriage: Yes. Patching without looking is not the whole action.[2][9]

GitLab.com was already on the patched version when 19.4.2 shipped. GitLab Dedicated tenants were patched with an internal release before the public patch. Self-managed is the queue.[4]

Same-day other KEV is CVE-2026-76418 (Cisco ASA/FTD unauthenticated DoS, due 1 Nov, forensic triage No). Different product. Do not collapse it into this GitLab ID.[1][2]

Who is affected

Named on this CVE ID (GitLab + NVD):[3][4]

GitLab CE/EE 19.2.x before 19.2.8
GitLab CE/EE 19.3.x before 19.3.5
GitLab CE/EE 19.4.x before 19.4.2

CSA Singapore repeats the same three branches and the unauthenticated-RCE impact.[10]

Not named on 97229: GitLab 18.x, 19.0, 19.1, 19.5. Do not invent a 97229 status for those lines. The sibling regexp overflow CVE-2026-110264 does go back to 7.0, with floors 18.11.13 / 19.0.10 / 19.1.9 / 19.2.9 / 19.3.6 / 19.4.3 / 19.5.1. That is a separate advisory. If you are still on 18.x, 110264 is why you still need a patch this month - not because 97229 listed you.[7]

CISA's KEV notes field: other products can potentially be affected by the same underlying Ruby/Onigmo integer overflow in a CI/CD regular-expression compiler. Ruby's own scope is narrower: you are in scope only if the app compiles a regexp from a string the attacker controls (Regexp.new, Regexp.union, Regexp.compile, or interpolating into /#{input}/). Apps that only use developer-written patterns are not affected. Regexp.timeout does not protect against these bugs. Length limits do not reliably protect either.[2][5]

Out of scope for this CVE ID unless another advisory says so: WordPress, cPanel, Plesk, Proxmox, Cisco ASA.

What to do now

Inventory the running GitLab, not the package sitting in apt cache. Help → Help in the UI, or the omnibus version file.

dpkg -l gitlab-ce gitlab-ee 2>/dev/null
rpm -q gitlab-ce gitlab-ee 2>/dev/null
cat /opt/gitlab/version-manifest.txt | head

Upgrade to at least the floor for this CVE, then keep going to the current patch on that major. GitLab: 19.2.8 / 19.3.5 / 19.4.2. If you are already on 19.4.2, you have 97229 closed; 19.4.3 / 19.5.1 is the sibling 110264 floor. Single-node Linux-package upgrades stop GitLab while migrations run. Multi-node can use GitLab's zero-downtime procedure. Pause CI jobs, match Runner to the target GitLab version, then upgrade.[4][7][8]

# Ubuntu / Debian - latest package from GitLab's repo
sudo apt update && sudo apt install gitlab-ee
# Community Edition:
# sudo apt update && sudo apt install gitlab-ce

# RHEL / Alma / Rocky / OL 8/9
sudo dnf upgrade gitlab-ee
# sudo dnf upgrade gitlab-ce

Pin a specific build if your upgrade path has stops: gitlab-ee=<version>-ee.0 on apt, gitlab-ee-<version>-ee.0.el9 on dnf. GitLab's package docs are the source for those suffixes; do not skip required intermediate majors.[8]

If you cannot upgrade today, take the instance off the public internet (VPN / allowlist). There is no vendor “disable CI lint” workaround in the 19.4.2 advisory that we will invent. Isolation is the stopgap.
Hunt before you declare done. GitLab published six threat detections for self-managed: Onigmo native worker crash; Graphql cilint hostile regexp; ci regexp oversized non ascii path; ci regexp guard rejection; ci lint workhorse worker crash; ci lint scripted client error burst. Use those names in whatever SIEM GitLab documents for your edition. We are not publishing detection YAML.[4]
Ruby apps that compile untrusted patterns (not GitLab): upgrade to Ruby 4.0.9 / 3.4.12 / 3.3.13 or stop compiling attacker-controlled regexes. Ruby did not assign its own CVEs for these Onigmo fixes; track GitLab's IDs in scanners for now.[5]

Versions with no clean vendor patch

GitLab versions before 19.2 are not in the 97229 range. They may still be in CVE-2026-110264 (from 7.0). Upgrade or isolate; do not read “not named on 97229” as “safe.”[4][7]
EOL GitLab (anything GitLab no longer patches): there is no 19.4.2 for you. Replace the install.
Source / Helm / Operator installs: the same version floors apply. Use GitLab's upgrade page for that method; the apt lines above are Linux-package only.[8]
Vendor appliances that embed GitLab: wait for that vendor's build. Isolate until then.

How to spot a compromise

CISA did not publish IoCs for 97229. We are not inventing them.

GitLab's detection names above are the vendor's hint: CI lint / GraphQL ci lint / workhorse / Onigmo worker crashes around hostile regexes. Also look at the host the way you would after any unauth RCE on a GitLab box: new SSH keys under git / root, unexpected gitlab-rails / puma children spawning shells, new deploy keys, CI YAML that is not yours, outbound curl/wget from the git user.

Isolate first. Keep logs. We are not publishing exploit steps.

FAQ

Is there a patch? Yes, since 12 October 2026. The new fact is CISA KEV on 29 October, due 1 November, not a missing GitLab package.

Is this remote unauth RCE? GitLab and NVD both describe an unauthenticated user executing code on the GitLab server. GitLab hedges with “under certain conditions.” We do not drop that hedge.

Does GitLab.com need a patch from me? GitLab says GitLab.com was already patched when 19.4.2 shipped. Dedicated too. Self-managed is you.[4]

What about CVE-2026-76418? Cisco ASA/FTD DoS, same KEV day, different product.[1]

What about CVE-2026-110264? Sibling Onigmo overflow, not on KEV in the catalog we fetched, wider version range, patched 21 October. Take that patch too. Do not treat 19.4.2 as the end of the regexp work.[2][7]

Does a Runner upgrade fix this? No. The bug is on the GitLab server compiling CI regexes. Runner should still match the GitLab version after you upgrade, per GitLab's package upgrade page.[8]

Honesty

We did not exploit this. No CI-lint PoC was run.
CISA's KEV row is evidence-of-exploitation plus a due date. We have no victim names, sample counts, or a CISA forensic packet.
NVD is Undergoing Analysis. The 10.0 is GitLab Secondary, not an NVD Primary.
GitLab's “under certain conditions” is in the advisory. We kept it.
Ruby has not requested Ruby CVE IDs for these Onigmo fixes; they said so on 23 October.
Cloud-hosted GitLab.com / Dedicated status is GitLab's statement, not a probe we ran.

Sources

[1] https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog - CISA alert 29 Oct 2026 two KEVs [2] https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json - CISA KEV JSON catalogVersion 2026.10.29 [3] https://nvd.nist.gov/vuln/detail/CVE-2026-97229 - NVD CVE-2026-97229 [4] https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released - GitLab Critical Patch 19.4.2/19.3.5/19.2.8 [5] https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves - Ruby regexp compilation fixes 23 Oct 2026 [6] https://www.cyber.gc.ca/en/alerts-advisories/gitlab-security-advisory-av26-1028 - CCCS AV26-1028 Update 1 [7] https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released - GitLab Critical Patch 19.5.1 sibling CVE-2026-110264 [8] https://docs.gitlab.com/update/package - GitLab Linux package upgrade [9] https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk - BOD 26-04 [10] https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-141 - CSA Singapore AL-2026-141