As cited
Copy frozen at (site build).
vulnerabilities
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
GitLab released patches for CVE-2026-97229, a critical integer overflow in CI/CD regular-expression handling affecting versions 19.2 through 19.4.1. Rapid7 researchers demonstrated reliable remote code execution as the git user on vulnerable instances by exploiting an inline comment to bypass repeat-count validation, triggering unsafe UTF-8 recompilation that produces oversized pcode, and then redirecting the Onigmo VM through a controlled bitmap to invoke system commands via the unauthenticated CI lint application programming interface (API).
Why it matters: Self-managed GitLab operators running versions 19.2 before 19.2.8, 19.3 before 19.3.5, or 19.4 before 19.4.2 must patch immediately, as CVSS 10.0 unauthenticated remote code execution can be triggered by pushing a malicious CI configuration to a public project and sending a single API request.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
GitLab released patches on October 12, 2026, for CVE-2026-97229, a critical integer overflow in CI/CD regular expression handling that allows unauthenticated remote code execution. Rapid7 researchers developed a proof-of-concept demonstrating arbitrary command execution as the git user by exploiting unsafe UTF-8 recompilation in the Onigmo regex engine combined with integer wraparound in quantifier bounds. The vulnerability affects GitLab CE and EE versions 19.2 through 19.4 and requires the attacker to push malicious configuration to a public project, then trigger a CI linting request through an unauthenticated application programming interface (API) endpoint.
Why it matters: Self-managed GitLab installations running vulnerable versions 19.2 before 19.2.8, 19.3 before 19.3.5, or 19.4 before 19.4.2 must patch immediately; the flaw enables complete system compromise without authentication if a public project exists under attacker control.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
On October 12, 2026, GitLab released patches for CVE-2026-97229, an integer overflow in its CI/CD regular expression handling that allows unauthenticated remote code execution. Rapid7 researchers developed a working proof of concept that chains integer overflow during regex compilation with UTF-8 recompilation outside the timeout window, ultimately achieving arbitrary command execution as the Git system account. The exploit requires prior write access to push a malicious configuration to a public repository, then triggers execution through an unauthenticated CI lint application programming interface (API) request.
Why it matters: Self-managed GitLab CE and EE users running versions 19.2 before 19.2.8, 19.3 before 19.3.5, or 19.4 before 19.4.2 must patch immediately, as unauthenticated attackers with access to any public project can execute commands at the system level.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
GitLab released patches on October 12, 2026 to fix CVE-2026-97229, a critical integer overflow in its CI/CD regular expression handling that permits unauthenticated remote code execution. Rapid7 researchers demonstrated a working proof of concept exploiting the flaw through GitLab's CI lint application programming interface (API) by encoding malicious instructions within a crafted regex pattern and repository path. The vulnerability affects GitLab CE and EE versions 19.2 through 19.4 unless updated, with self-managed instances requiring immediate patching.
Why it matters: GitLab administrators running versions 19.2 before 19.2.8, 19.3 before 19.3.5, or 19.4 before 19.4.2 must patch immediately, as an unauthenticated attacker can achieve code execution as the git system account through the CI lint API.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
GitLab released patches on October 12, 2026 to fix CVE-2026-97229, a critical integer overflow in the CI/CD regular expression handler affecting versions 19.2, 19.3, and 19.4. Rapid7 researchers demonstrated reliable unauthenticated remote code execution by exploiting the overflow through specially crafted repository paths and inline regex comments that bypass size validation checks, ultimately allowing arbitrary commands to run as the git system user.
Why it matters: GitLab CE and EE users on unpatched versions 19.2 before 19.2.8, 19.3 before 19.3.5, or 19.4 before 19.4.2 must upgrade immediately; an attacker with write access to a public project can trigger code execution via the unauthenticated CI lint application programming interface (API) endpoint, putting self-managed instances at severe risk until patching is complete.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
GitLab released patched versions 19.4.2, 19.3.5, and 19.2.8 on October 12, 2026 to address CVE-2026-97229, a critical integer overflow in its continuous integration and continuous delivery (CI/CD) regular-expression handler that allows unauthenticated command execution. Researchers developed a proof-of-concept exploit that leverages a comment-based bypass to hide an oversized quantifier from validation checks, causing the Onigmo regex compiler to expand an integer overflow and emit controllable bytecode that redirects execution through LibRuby into arbitrary system commands. The vulnerability affects GitLab Community Edition and Enterprise Edition versions 19.2 through 19.4 across all deployment types except Dedicated, though GitLab.com was patched before disclosure and no wild exploitation was reported at the time of advisory publication.
Why it matters: Self-managed GitLab instances running versions 19.2, 19.3, or 19.4 must upgrade immediately, as the flaw enables unauthenticated remote code execution through the CI lint application programming interface (API) endpoint when a public project is writable by an attacker.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
GitLab released patches on October 12, 2026 to address CVE-2026-97229, a critical integer overflow in its CI/CD regex handling that allows unauthenticated remote code execution. Researchers at Rapid7 demonstrated a complete proof-of-concept exploit chain that manipulates the Onigmo regex compiler through crafted repository paths and CI configuration, ultimately achieving command execution as the git system user. The vulnerability affects GitLab Community Edition and Enterprise Edition versions 19.2 through 19.4 unless patched to 19.2.8, 19.3.5, or 19.4.2.
Why it matters: Self-managed GitLab instances running vulnerable versions face immediate remote code execution risk from unauthenticated attackers who can push to public repositories; patching to the specified releases is required today.
- Source published
- First seen by Cybersecurity Tracker