Key facts
- GitLab released security updates on Oct. 12, 2026, in Community Edition and Enterprise Edition versions 19.4.2, 19.3.5, and 19.2.8 to resolve CVE-2026-97229, urging self-managed installations to upgrade immediately.
- Shadowserver reported tracking more than 11,300 GitLab instances vulnerable to another regex compiler flaw, CVE-2026-110264, out of roughly 39,000 daily scanned instances.
- CISA has added six GitLab vulnerabilities to its Known Exploited Vulnerabilities Catalog since November 2021, with at least one used in ransomware incidents.
- CVE-2026-97229 has a CVSS score of 10.0, the highest possible score.
As of Nov. 2, 2026, Shadowserver has counted more than 1,000 internet-facing GitLab servers without a patch for CVE-2026-97229, a remote code execution flaw at the maximum severity level.
CISA confirmed active exploitation of CVE-2026-97229 in the wild on Oct. 30, 2026. The agency put the flaw on its Known Exploited Vulnerabilities Catalog and told federal agencies to secure their servers by Sunday.
On Oct. 12, 2026, GitLab said CVE-2026-97229 comes from an integer overflow weakness in its CI/CD Regular Expression Compiler caused by insufficient validation, letting an unauthenticated user run arbitrary code under specific conditions. “GitLab has not said what those conditions are.”
Secure.com gives CVE-2026-97229 a CVSS score of 10.0, the maximum possible. Help Net Security says its vector allows remote triggering with low complexity and without privileges or any user interaction. It lists affected releases as running from 19.2 below 19.2.8, from 19.3 below 19.3.5, and from 19.4 below 19.4.2 across Community and Enterprise Editions.
On Oct. 12, 2026, GitLab issued security updates for Community Edition and Enterprise Edition, in versions 19.4.2, 19.3.5 and 19.2.8, to fix CVE-2026-97229 and urged operators of self-managed servers to upgrade right away. The company said its GitLab.com service already had a patch when the advisory was published and that GitLab Dedicated customers needed no action. The Hacker News noted that versions 19.4.3 and 19.3.6 apply database updates during upgrade, taking single-node servers offline, while multi-node installations can patch with no downtime through GitLab’s zero-downtime process.
On Nov. 2, 2026, Secure.com said the integer overflow sits in Ruby’s built-in Onigmo regular expression engine rather than GitLab application code, meaning ordinary GitLab updates do not repair instances running custom Ruby distributions unless the underlying interpreter moves to versions 3.3.13, 3.4.12 or 4.0.9. Ruby released its Onigmo fix without filing a separate CVE.
Rapid7 researchers got arbitrary code execution to run on an unpatched GitLab Community Edition 19.4.1 image on Oct. 13, 2026, and said exploitation needs a malicious .gitlab-ci.yml file plus a UTF-8 path committed to a public project branch. They also found no confirmed in-the-wild exploitation as of that date. A standard user account is enough on self-managed installations where people can create public projects.
Secure.com said administrators should turn off open registration, block anonymous access to CI lint endpoints with a web application firewall or reverse proxy, check interpreter versions using ruby -v, and install versions such as 19.5.1, 19.4.3, 19.3.6 or 19.2.9. It also said a working exploit went public on Oct. 13 and a Metasploit module appeared on Oct. 30.
Agencies of the federal government had until Nov. 1 to fix CVE-2026-97229, CISA said, while Civilian Executive Branch agencies were ordered to remediate by Sunday under Binding Operational Directive 22-01. Since November 2021, the agency has placed six GitLab flaws in that catalog, and at least one has appeared in ransomware incidents.
Shadowserver said on Nov. 2, 2026, that it is tracking over 11,300 GitLab instances exposed to CVE-2026-110264, out of roughly 39,000 instances it scans each day. GitLab says attackers have not been observed using CVE-2026-110264, which carries a CVSS rating of 10.0, and the flaw was absent from the CISA KEV catalog as of Oct. 22.
CVE-2026-110264 affects every GitLab version back to 7.0, released in 2014. GitLab fixed it on Oct. 21 across seven versions, including backports to 18.11.13, 19.0.10, 19.1.9 and 19.2.9, four of them older than GitLab normally patches. Under its support policy, it normally patches only the current version and the two preceding monthly releases, 19.5, 19.4 and 19.3 on Oct. 21.
GitLab published detection rules called Onigmo native worker crash and Org mode render error burst in its open-source TLDR framework, which uses Sigma format on application logs. For CVE-2026-110264, it provides no temporary workaround, so the patch is the only certain defense. GitLab Dedicated customers already have the patch for that second flaw on internal release 19.3.5-internal0 or 19.4.2-internal0 and newer.
The Hacker News said the October 21 release resolved 11 security problems altogether, including one critical issue alongside high, medium and low flaws. It included CVE-2026-15723, rated 8.2, which lets someone who is signed in take over another person’s account when SAML and LDAP auto-linking are both turned on, and CVE-2026-112212, rated 7.5, a flaw that poisons caches in OAuth and OpenID Connect endpoints and can redirect sign-in flows.
The researcher joaxcar told GitLab’s HackerOne bug bounty program about CVE-2026-97229. The Hacker News said it marks the fourth remote-code-execution bug in GitLab’s regular-expression engine found within one month and the earliest of these to reach releases earlier than 19.2. Related earlier fixes include CVE-2026-93577 and CVE-2026-89078, each rated 9.9 and needing a logged-in account, patched Sept. 23, 2026. Undercode News said GitLab fixed CVE-2026-0723 in January, a high-severity two-factor authentication bypass, and CVE-2026-85706 in September, a maximum-severity commits API flaw that may expose login details.
GitLab says its DevSecOps platform serves more than 70 million registered users and is used by more than 50 percent of Fortune 100 companies globally. Secure.com said one Linux distribution project updated its GitLab server yet stayed vulnerable, learning of the problem only after its workers failed eight times over two days, and four of those crashes moved partway through an exploit attempt.
GitLab says its GitLab.com service already had a patch when the advisory was published and that Dedicated customers needed no action for CVE-2026-97229, while fixed versions 19.4.2, 19.3.5 and 19.2.8 are available for self-managed servers. Secure.com additionally cites 19.5.1, 19.4.3, 19.3.6 and 19.2.9. It said a patch for CVE-2026-97229 does not also close CVE-2026-110264. The Hacker News said GitLab offers no interim workaround for CVE-2026-110264, so its October 21 fixes remain the only certain protection there.
Join the discussion