Vulnerability of 29 October 2026 · CVE-2026-97229

GitLab Integer overflow

10.0 CVSS · criticalExploited

Integer overflow in GitLab. Exploitable over the network, without logging in, without any user action. CVSS 10.0 (critical). According to CISA it is already being exploited. Fixed in 19.2.8, 19.3.5 and 19.4.2.

Vendor security advisory

docs.gitlab.com · The vendor’s information prevails.

At a glance

CVE

CVE-2026-97229

Product

GitLab

Vendor

GitLab

Affected versions

≥ 19.2, < 19.2.8
≥ 19.3, < 19.3.5
≥ 19.4, < 19.4.2

per the vendor or CVE issuer

Fixed in

19.2.8, 19.3.5, 19.4.2

CVSS

10.0 (critical)
CVSS 3.1, scored by the CVE issuer
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Known exploited

Yes, per CISA (in the KEV catalog since 29 October 2026)

Weakness type

CWE-190 (Integer overflow)

Published

13 October 2026

Last modified

31 October 2026

What to do

Update to a fixed version: 19.2.8, 19.3.5 and 19.4.2 or later, depending on the release line you run.
Read the vendor’s report: it gives the exact versions and, where available, workarounds in case you cannot update right away.
Since it is already exploited: after updating, check whether the system was compromised before.
Also check test, staging and forgotten installations of the same software.

Vendor security advisory ↗

Original description

From the CVE record. The summary above is built from the structured data.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Name at CISA: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

Official references

docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-releasedRelease notesVendor advisory
gitlab.com/gitlab-org/gitlab/-/work_items/630686Broken link
hackerone.com/reports/4055749Permissions Required
hackerone.com/reports/4058589Permissions Required
cisa.gov/known-exploited-vulnerabilities-catalogUS government
github.com/rapid7/metasploit-framework/pull/22017
ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves

Sources

Data from NIST’s NVD and CISA’s KEV catalog, retrieved on 1 November 2026. This product uses data from the NVD API but is not endorsed or certified by the NVD. No liability is accepted for this information.

NVD entry ↗CVE.org record ↗CISA KEV catalog ↗

Which software versions does your website give away? The free security check finds out.

Check for free