GitLab patches critical integer overflow vulnerability in CI CD pipeline

GitLab released security updates on October 12, 2026, to address a critical integer overflow vulnerability tracking as CVE-2026-97229, Rapid7 reported. The flaw resides within the platform's CI CD regular-expression handling components. GitLab assigned the security flaw a maximum CVSS score of 10.0 and stated that it could allow remote code execution by an unauthenticated user. [1]

According to Rapid7, the underlying vulnerability stems from an integer overflow in Onigmo regex compilation used by GitLab CI. When compiled, the overflow can lead to native code execution on the target system. Rapid7 confirmed that a public proof-of-concept exploit is available. [1]

The vulnerability affects GitLab Community Edition and Enterprise Edition versions 19.2 prior to 19.2.8, 19.3 prior to 19.3.5, and 19.4 prior to 19.4.2, Rapid7 reported. Security researcher joaxcar originally discovered and reported the issue to the vendor through the HackerOne bug bounty platform. [1]

GitLab develops an open-core DevOps software package that provides distributed version control, access control, task management, and continuous integration capabilities. To address the risk of potential unauthenticated remote code execution, administrator teams should upgrade instances immediately to patched versions 19.4.2, 19.3.5, or 19.2.8. [1][5]