critical severityConfidence highHistorical record

GitLab critical patch: no-login code execution on self-managed servers (CVE-2026-97229)

GitLab shipped an out-of-band critical patch release on 2026-10-12 (19.4.2, 19.3.5, 19.2.8) for CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler. GitLab says a specially crafted regular expression in a CI/CD configuration could let an unauthenticated user execute arbitrary code on the GitLab server, rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Affected: GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2. GitLab.com is already patched; GitLab Dedicated needs no action. The same release fixes 23 other issues, five rated high, and the bug-fix list adds Ruby regexp program size and repeat-range double-free patches for Ruby 3.3 and 3.4. Not on CISA KEV at publish time and GitLab reports no exploitation.

Also tracked as CVE-2026-97229 · Integer Overflow issue in CI/CD Regular Expression Compiler impacts GitLab CE/EE · Integer Overflow or Wraparound in GitLab · GitLab Critical Patch Release 19.4.2 19.3.5 19.2.8

First observed
Oct 13, 2026
Last observed
Oct 13, 2026
Last reviewed
Oct 13, 2026
Tracking ended
Oct 13, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

GitLab has not published how an unauthenticated user gets a crafted CI/CD configuration evaluated; the HackerOne reports and GitLab work item stay private until 90 days after the fix. The link between the CVE and the bundled Ruby regexp patches is HOL's reading of the release bug-fix list, not a GitLab statement. No exploitation reported and not on CISA KEV as of catalog 2026.10.08.

  • GitLab.com users are not in scope; the SaaS is already patched.
  • GitLab Dedicated customers need no action.
  • GitLab 19.1 and earlier are outside the CVE-2026-97229 affected range, though other fixes in the same release still apply.
  • GitLab Runner is not listed as affected; runners still execute whatever a compromised server sends.
  • No published workaround from GitLab; restricting network reach and disabling open sign-up is HOL's interim suggestion, not a fix.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

No Guard coverage mapping is published for this record.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Vendor action

    GitLab released critical patch versions 19.4.2, 19.3.5 and 19.2.8 for CE and EE and recommended all self-managed installs upgrade immediately. GitLab.com already patched.

  2. Disclosure

    CVE-2026-97229 published to the CVE List (Integer Overflow or Wraparound in GitLab, critical, CVSS 10.0).

  3. Update

    HOL Guard published BREAKING operator blog coverage with upgrade commands, version check and scope notes.

  4. Update

    NVD received CVE-2026-97229 with CWE-190 (integer overflow or wraparound); analysis pending.

Publication clock: 1.7 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • GitLab CE/EE 19.2@>=19.2.0 <19.2.8gitlabpackage
  • GitLab CE/EE 19.3@>=19.3.0 <19.3.5gitlabpackage
  • GitLab CE/EE 19.4@>=19.4.0 <19.4.2gitlabpackage

Sources

Every claim on this record is traceable to the sources below.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-C76C8263