CVE-2026-97229 is an unauthenticated remote-code-execution issue in GitLab CE and EE, the self-hosted editions of the platform many teams use to keep source code, review changes, run automated builds and tests, publish artifacts, and deploy software. That combination makes a GitLab server unusually valuable: it commonly sits beside production credentials, source code, runners and deployment paths.
GitLab says a specially crafted regular expression in CI/CD configuration can, under certain conditions, cause arbitrary code execution on the GitLab server without an account. The company issued its patch release on October 12, 2026; the CVE record followed on October 13. GitLab.com was already patched at disclosure, and GitLab Dedicated customers were told they need not act. The urgent work is with self-managed operators.
An arithmetic check fails open
The bug is in the regular-expression compiler bundled with Ruby and used while GitLab processes CI/CD configuration. Regular expressions describe text patterns; bounded repeats tell the engine to repeat a pattern a specified number of times. The compiler tries to stop enormous repeat expansions before they consume unsafe amounts of space.
That safety check multiplied two values: the existing pattern length and the repeat's lower bound. Nested bounded repeats can make that multiplication overflow—wrap around to a small number—so an oversized expression appears to pass the limit. The resulting malformed compiler state can be driven to code execution. GitLab's published backport replaces multiplication-based validation with division, avoiding the overflow:
#define IS_EXPAND_LIMIT_OK(tlen, n) \
((n) <= 0 || (tlen) <= QUANTIFIER_EXPAND_LIMIT_SIZE / (n))The patch also adds a later size check while emitting regular-expression bytecode. That defence in depth matters because the first check is intended to prevent the dangerous expansion, while the later one rejects a compiled program that exceeds the offset type's capacity.
GitLab's advisory establishes that no authentication is required, but public material does not confirm the exact HTTP request path that carries attacker-controlled CI/CD configuration to this compiler. The referenced HackerOne reports were not publicly accessible during the research, and no public end-to-end proof of concept or working exploit has surfaced. Public regression tests exercise the compiler defect, but they are not a demonstrated unauthenticated GitLab exploit.
Internet-facing self-managed servers need the fastest response
The affected releases are CE and EE 19.2 through 19.2.7, 19.3 through 19.3.4, and 19.4 through 19.4.1. Upgrade to 19.2.8, 19.3.5, or 19.4.2 respectively; versions before 19.2 are marked unaffected in the published CVE record. Do not stop at 19.3.4: GitLab's current guidance names 19.3.5 after 19.3.4 had an unrelated merge-request-page issue.
As of October 13, 2026, exploitation in the wild could not be confirmed, and CVE-2026-97229 was not present in CISA's Known Exploited Vulnerabilities catalogue. That catalogue snapshot predates disclosure, so teams should recheck it rather than treating absence as a safety signal. No victim, campaign, or specific compromise tied to the flaw could be confirmed.
Prioritize exposed instances, then review GitLab and runner logs for unusual CI/CD configuration submissions or unexpected server-side process activity around the upgrade window. Enterprises, financial firms, telecoms, government agencies, universities, and other regulated organisations commonly run self-managed GitLab precisely because it centralizes sensitive development work. Patch now, reduce unnecessary public exposure, and use SecAlerts to monitor the software your organisation actually runs and alert on new vulnerabilities affecting it.
