GitLab Regex Integer Overflow: Self-Managed Users Urged to Patch Critical Unauthenticated RCE
Self-managed GitLab users must upgrade to versions 19.4.2, 19.3.4 or 19.2.8 to fix a critical integer overflow flaw allowing remote code execution.
Key points
- GitLab released patches on 12 October 2026 for versions 19.4.2, 19.3.4 and 19.2.8 to address 24 security issues.
- CVE-2026-97229 is a critical vulnerability in the CI/CD regular expression compiler that allows unauthenticated arbitrary code execution.
- CERT-EU advises immediate upgrades for all self-managed instances, prioritizing those exposed to the internet.
GitLab issued patch releases for its Community Edition and Enterprise Edition on 12 October 2026. The updates, versions 19.4.2, 19.3.4 and 19.2.8, resolve twenty-four distinct security issues. Among these is a critical flaw that permits unauthenticated attackers to execute arbitrary code on the server. The European Union Agency for Cybersecurity (CERT-EU) published an advisory urging immediate action for self-managed deployments.
The risk
The primary threat is CVE-2026-97229, which carries a CVSS score of 10.0. According to the CERT-EU advisory, the vulnerability resides in the CI/CD regular expression compiler. Weak validation of regular expressions causes an integer overflow. An attacker can exploit this by injecting a specially crafted expression into a CI/CD configuration. This action triggers arbitrary code execution on the server without requiring authentication.
Who is exposed
Self-managed instances of GitLab CE and EE are affected. The advisory does not specify version ranges for exposure, but the fix applies to the 19.4, 19.3 and 19.2 release lines. Internet-facing instances face the highest immediate risk due to the unauthenticated nature of the exploit. Other vulnerabilities in the same release include a cross-site scripting flaw (CVE-2026-92883) and an authorization issue (CVE-2026-16301).
Cost and compliance
The authorization flaw, CVE-2026-16301, allows developers to run pipelines on protected branches without permission. This could undermine compliance controls that rely on branch protection rules. Additionally, a cache poisoning bug rated 8.2 could expose protected CI/CD variables. These issues collectively threaten the integrity of the software development lifecycle and data confidentiality.
What to watch
Managers should verify that their self-hosted GitLab instances are running the latest patched versions. Prioritize upgrading any instance accessible from the public internet. Monitor CI/CD pipelines for unusual activity or unauthorized executions. That suggests a coordinated effort to patch all environments is necessary to mitigate the risk of compromise.
What to do and how to stay safe: GitLab
- Inventory all self-managed GitLab CE and EE instances to identify those running versions prior to 19.4.2, 19.3.4 or 19.2.8.
- Schedule immediate upgrades for internet-facing instances to patch CVE-2026-97229 and other critical flaws.
- Review CI/CD configurations for any unusual or unapproved regular expressions that may indicate exploitation attempts.
- Audit branch protection settings and pipeline permissions to ensure no unauthorized access has occurred via CVE-2026-16301.
Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First
General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of the GitLab vulnerability?
CVE-2026-97229 has a CVSS score of 10.0, which is rated as critical.
Which GitLab versions need to be updated?
Users should update to versions 19.4.2, 19.3.4 or 19.2.8 to fix the security issues.
Is authentication required to exploit the main vulnerability?
No, the vulnerability allows an unauthenticated attacker to execute arbitrary code on the server.
