{"id":"gitlab-regex-compiler-rce-cve-2026-97229-oct","category":"patch","status":"live","title":"GitLab CE/EE critical remote code execution flaw CVE-2026-97229 exploited in attacks; update to 19.4.2, 19.3.5 or 19.2.8","tldr":"GitLab's CVSS 10 flaw CVE-2026-97229 lets anyone run code on a self-managed GitLab server without logging in, and CISA says it's being exploited. Fixed in 19.4.2, 19.3.5 and 19.2.8. If you run your own GitLab, update now. GitLab.com is already patched.","summary":"CVE-2026-97229 is a maximum-severity flaw (CVSS 10.0) in the CI/CD regular expression compiler of GitLab Community Edition and Enterprise Edition. An unauthenticated attacker can send a specially crafted regular expression in a CI/CD configuration and run their own code on the GitLab server. GitLab fixed it on 12 October 2026 in versions 19.4.2, 19.3.5 and 19.2.8; affected versions are 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. GitLab.com and GitLab Dedicated were already patched, so the risk is to self-managed installations. On 29 October CISA added the flaw to its catalogue of vulnerabilities being used in attacks, and GitLab said it had detected exploitation attempts and released detections for self-managed instances. On 23 October Ruby separately released fixes for the underlying regular expression bugs in 4.0.9, 3.4.12 and 3.3.13. Shadowserver tracks nearly 2,800 internet-exposed GitLab Community Edition instances, with no patch figure given. A fix exists for every affected branch.","action":"If you or your business run your own GitLab server, update it to 19.4.2, 19.3.5 or 19.2.8 (or later) now, and ask your IT provider to check for signs of attack. If you use GitLab.com, there is nothing to do, as it is already patched.","product":"GitLab Community Edition and Enterprise Edition (self-managed)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-97229"],"tags":["gitlab","rce","kev","cisa","ci-cd","regex","self-hosted","zero-click"],"affected":["GitLab CE/EE 19.2 before 19.2.8","GitLab CE/EE 19.3 before 19.3.5","GitLab CE/EE 19.4 before 19.4.2"],"fixed":["19.2.8","19.3.5","19.4.2"],"matches":[],"sources":[{"kind":"advisory","title":"GitLab Patch Release: 19.4.2, 19.3.5, 19.2.8","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","by":"GitLab","date":"2026-10-12"},{"kind":"advisory","title":"Regexp fixes for GitLab CVEs","url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves","by":"Ruby","date":"2026-10-23"},{"kind":"news","title":"CISA says max severity GitLab flaw now exploited in the wild","url":"https://bleepingcomputer.com/news/security/hackers-now-exploiting-max-severity-gitlab-flaw-in-attacks","by":"BleepingComputer","date":"2026-10-30"}],"started":"2026-10-12","closed":null,"created":"2026-11-03T21:52:09.173Z","updated":"2026-11-03T21:52:09.173Z","cve_notes":[{"cve":"CVE-2026-97229","name":"Unauthenticated code execution in GitLab's CI/CD regex compiler","what":"An integer overflow in the regular expression compiler used for CI/CD configuration that lets an attacker with no login run their own code on a self-managed GitLab server using a crafted pattern.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-10-30","added":"2026-11-03T21:50:47.254Z","kind":"other","text":"BleepingComputer reported that Shadowserver tracks nearly 2,800 internet-exposed GitLab Community Edition instances, and did not say how many were patched. US federal agencies were told to secure their servers under a CISA deadline, which one report gives as 1 November.","url":"https://bleepingcomputer.com/news/security/hackers-now-exploiting-max-severity-gitlab-flaw-in-attacks","by":"BleepingComputer","patch":null},{"at":"2026-10-29","added":"2026-11-03T21:50:47.254Z","kind":"cisa-added","text":"CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog, confirming attacks in the wild. GitLab reported detecting exploitation attempts and published threat detections for self-managed instances.","url":"https://bleepingcomputer.com/news/security/hackers-now-exploiting-max-severity-gitlab-flaw-in-attacks","by":"BleepingComputer","patch":null},{"at":"2026-10-23","added":"2026-11-03T21:50:47.254Z","kind":"other","text":"Ruby released 4.0.9, 3.4.12 and 3.3.13 with fixes for the underlying bugs in its Onigmo regular expression engine, which GitLab had assigned four CVEs, including CVE-2026-97229. Ruby said only applications that compile patterns from attacker-controlled text are affected.","url":"https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves","by":"Ruby","patch":null},{"at":"2026-10-12","added":"2026-11-03T21:50:47.254Z","kind":"disclosed","text":"GitLab released patch versions 19.4.2, 19.3.5 and 19.2.8 for Community and Enterprise Edition, fixing CVE-2026-97229, a CVSS 10.0 flaw in the CI/CD regular expression compiler that let an unauthenticated attacker run code on the server. GitLab.com and GitLab Dedicated were already patched, and GitLab urged self-managed administrators to upgrade immediately.","url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/","by":"GitLab","patch":"patched"}],"url":"https://hard.fyi/live/gitlab-regex-compiler-rce-cve-2026-97229-oct/","json":"https://hard.fyi/api/live?id=gitlab-regex-compiler-rce-cve-2026-97229-oct"}