{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-C76C8263",
  "slug": "cve-2026-97229-gitlab-ci-regex-unauthenticated-rce",
  "title": "GitLab critical patch: no-login code execution on self-managed servers (CVE-2026-97229)",
  "aliases": [
    "CVE-2026-97229",
    "Integer Overflow issue in CI/CD Regular Expression Compiler impacts GitLab CE/EE",
    "Integer Overflow or Wraparound in GitLab",
    "GitLab Critical Patch Release 19.4.2 19.3.5 19.2.8"
  ],
  "summary": "GitLab shipped an out-of-band critical patch release on 2026-10-12 (19.4.2, 19.3.5, 19.2.8) for CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler. GitLab says a specially crafted regular expression in a CI/CD configuration could let an unauthenticated user execute arbitrary code on the GitLab server, rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Affected: GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2. GitLab.com is already patched; GitLab Dedicated needs no action. The same release fixes 23 other issues, five rated high, and the bug-fix list adds Ruby regexp program size and repeat-range double-free patches for Ruby 3.3 and 3.4. Not on CISA KEV at publish time and GitLab reports no exploitation.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "GitLab has not published how an unauthenticated user gets a crafted CI/CD configuration evaluated; the HackerOne reports and GitLab work item stay private until 90 days after the fix. The link between the CVE and the bundled Ruby regexp patches is HOL's reading of the release bug-fix list, not a GitLab statement. No exploitation reported and not on CISA KEV as of catalog 2026.10.08.",
  "firstObservedAt": "2026-10-13T01:05:46.166Z",
  "lastObservedAt": "2026-10-13T02:17:00.840Z",
  "publishedAt": "2026-10-13T02:50:38.769Z",
  "reviewedAt": "2026-10-13T02:50:30.232Z",
  "expiresAt": "2026-10-13T02:17:00.840Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "gitlab-release",
      "label": "GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8",
      "url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-10-12T00:00:00.000Z"
    },
    {
      "id": "cve-record",
      "label": "CVE-2026-97229 record (CVE List V5)",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97229",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-10-13T01:05:46.166Z"
    },
    {
      "id": "nvd",
      "label": "NVD CVE-2026-97229",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97229",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-10-13T02:17:00.840Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL Guard operator write-up",
      "url": "https://hol.org/blog/cve-2026-97229-gitlab-ci-regex-unauthenticated-rce",
      "sourceType": "other_primary",
      "observedAt": "2026-10-13T01:46:43.939Z"
    }
  ],
  "artifacts": [
    {
      "id": "gitlab-19-2",
      "artifactClass": "package",
      "ecosystem": "gitlab",
      "name": "GitLab CE/EE 19.2",
      "version": ">=19.2.0 <19.2.8",
      "defanged": false
    },
    {
      "id": "gitlab-19-3",
      "artifactClass": "package",
      "ecosystem": "gitlab",
      "name": "GitLab CE/EE 19.3",
      "version": ">=19.3.0 <19.3.5",
      "defanged": false
    },
    {
      "id": "gitlab-19-4",
      "artifactClass": "package",
      "ecosystem": "gitlab",
      "name": "GitLab CE/EE 19.4",
      "version": ">=19.4.0 <19.4.2",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "gitlab-patch",
      "occurredAt": "2026-10-12T00:00:00.000Z",
      "eventType": "vendor_action",
      "summary": "GitLab released critical patch versions 19.4.2, 19.3.5 and 19.2.8 for CE and EE and recommended all self-managed installs upgrade immediately. GitLab.com already patched.",
      "sourceIds": [
        "gitlab-release"
      ]
    },
    {
      "id": "cve-published",
      "occurredAt": "2026-10-13T01:05:46.166Z",
      "eventType": "disclosure",
      "summary": "CVE-2026-97229 published to the CVE List (Integer Overflow or Wraparound in GitLab, critical, CVSS 10.0).",
      "sourceIds": [
        "cve-record"
      ]
    },
    {
      "id": "hol-publish",
      "occurredAt": "2026-10-13T01:46:43.939Z",
      "eventType": "other",
      "summary": "HOL Guard published BREAKING operator blog coverage with upgrade commands, version check and scope notes.",
      "sourceIds": [
        "hol-blog"
      ]
    },
    {
      "id": "nvd-received",
      "occurredAt": "2026-10-13T02:17:00.840Z",
      "eventType": "other",
      "summary": "NVD received CVE-2026-97229 with CWE-190 (integer overflow or wraparound); analysis pending.",
      "sourceIds": [
        "nvd"
      ]
    }
  ],
  "coverage": [],
  "policies": [],
  "limitations": [
    "GitLab.com users are not in scope; the SaaS is already patched.",
    "GitLab Dedicated customers need no action.",
    "GitLab 19.1 and earlier are outside the CVE-2026-97229 affected range, though other fixes in the same release still apply.",
    "GitLab Runner is not listed as affected; runners still execute whatever a compromised server sends.",
    "No published workaround from GitLab; restricting network reach and disabling open sign-up is HOL's interim suggestion, not a fix."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-97229-gitlab-ci-regex-unauthenticated-rce/corrections"
}