GitLab CVE-2026-97229 Added to CISA KEV: Patch by Nov 1

CISA added GitLab CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on 29 October 2026, with a federal remediation deadline of 1 November. The flaw is a CVSS 10.0 integer overflow in the regular expression compiler that GitLab uses for CI/CD configuration, and GitLab says it can let an unauthenticated user run code on the server. Self-managed GitLab 19.2, 19.3 and 19.4 are affected. Upgrade to a fixed release today, then check the instance for signs of earlier abuse.

What happened

GitLab shipped a critical patch release (19.4.2, 19.3.5 and 19.2.8) on 12 October 2026. The top item was CVE-2026-97229, titled "Integer Overflow issue in CI/CD Regular Expression Compiler". GitLab's description says that under certain conditions a specially crafted regular expression in a CI/CD configuration could let an unauthenticated user execute arbitrary code on the GitLab server, because the regular expression was not validated well enough. The researcher Johan Carlsson (joaxcar) reported it through GitLab's HackerOne bug bounty program.

On 23 October the Ruby core team released Ruby 4.0.9, 3.4.12 and 3.3.13. These fix the bugs in Onigmo, Ruby's regular expression engine, that sit underneath CVE-2026-97229 and three related GitLab CVEs. Separately, a researcher, Jonah Burgess, has published a public proof-of-concept; the write-up does not give a release date. CISA listed the CVE in the KEV catalog on 29 October. The KEV entry marks forensic triage as required under BOD 26-04 and lists ransomware use as unknown. CISA has not published who is exploiting it or against which targets.

Who is affected by GitLab CVE-2026-97229

The official CVE record lists these affected versions of GitLab Community Edition and Enterprise Edition:

19.2 before 19.2.8
19.3 before 19.3.5
19.4 before 19.4.2

GitLab.com was already running the fix when the advisory went out, and GitLab Dedicated tenants were patched through an internal release before publication. The exposure is on self-managed instances, which covers Linux package, Helm chart and source installs, because GitLab's advisory says every deployment type is affected unless one is named.

One version discrepancy matters. BleepingComputer's 12 October report listed 19.3.4 as the fixed 19.3 build. GitLab's own advisory names 19.3.5, and notes that 19.3.4 had a bug affecting merge request pages when the Ona integration was enabled. Use the vendor's numbers: 19.3.5 or later.

The CISA entry also says other products may be affected by the same underlying Ruby and Onigmo integer overflow. Any Ruby application that compiles regular expressions from user input is in scope for the Ruby fix, even if it has nothing to do with GitLab. Our guide on fixing the Ruby Onigmo regexp bugs in your own applications covers that side.

Technical analysis

GitLab compiles regular expressions supplied by its users, such as patterns in CI configuration, with Ruby's Regexp.new. According to the Ruby advisory, specially crafted patterns can corrupt memory while Ruby compiles them, and GitLab found that this could be turned into remote code execution. For CVE-2026-97229 the bug is an integer overflow in the size of the compiled pattern. If you want the background on how a size calculation that wraps around becomes memory corruption, read what an integer overflow vulnerability is.

Two points from the Ruby team change how you should think about mitigation:

Regexp.timeout does not protect against these bugs. Timeouts address slow matching, and this flaw triggers during compilation.
Limiting pattern length is not a reliable defense, because some of the bugs fire on short patterns.

The public proof-of-concept write-up gives the real-world precondition. GitLab's advisory says "unauthenticated", but the researcher reports that an attacker needs to be able to push a branch to a public project on the target instance, and that commands run as GitLab's git account rather than as an administrator. On an instance with open sign-up and public projects, that bar is low. The same write-up warns that the exploit needs a lot of memory and can destabilize the service, and that an HTTP 502 response on its own does not prove exploitation.

CVE-2026-97229 is one of four GitLab CVEs tied to Onigmo fixes. The Ruby advisory maps them: CVE-2026-89078 (double free in the regex parser) and CVE-2026-93577 (integer overflow in the regex compiler) were fixed in GitLab 19.4.1, CVE-2026-97229 in 19.4.2, and CVE-2026-110264 (overflow of internal IDs in a pattern with many repeats) in 19.5.1. Only CVE-2026-97229 is in KEV as of catalog version 2026.10.29. That is one more reason to land on a current release instead of the minimum fixed build. We explain why this class of bug keeps recurring in why untrusted regex patterns are a code execution risk.

What to do now

Find every self-managed GitLab instance, including test and staging servers, and record its exact version.
Upgrade. The minimum fixed builds are 19.2.8, 19.3.5 and 19.4.2. GitLab's latest patch release, published 29 October 2026 (19.5.3, 19.4.5, 19.3.7, 19.2.10), also removes trust for compromised eMudhra intermediate CA certificates (CVE-2026-111943). If you take it, GitLab says self-hosted GitLab Runner must be updated separately to 19.5.1.
If you cannot upgrade before the 1 November deadline, reduce who can push to public projects. Our earlier guide on locking down public projects on self-managed GitLab walks through the visibility settings. Treat this as a stopgap, not a fix.
Because CISA flagged forensic triage, assume an exposed, unpatched instance may already be compromised. Review recent CI/CD configuration changes for new or unusual regular expressions, recent branch pushes from unfamiliar accounts, and any crashes or restarts of GitLab worker processes.
If you find evidence of compromise, follow the same playbook as for any GitLab server takeover: preserve logs, rebuild from known-good media and rotate every secret the server held. Our piece on why one file read can compromise your entire CI/CD platform lists what to rotate.

GitLab released six threat detections for self-managed customers alongside the advisory. They are named "Onigmo native worker crash", "Graphql cilint hostile regexp", "ci regexp oversized non ascii path", "ci regexp guard rejection", "ci lint workhorse worker crash" and "ci lint scripted client error burst". The names tell you where to look: native worker crashes, hostile patterns sent to the CI lint endpoints, and bursts of client errors. Load them into your SIEM if you run one.

What to watch next

CISA or GitLab publishing exploitation details such as actors, targets or indicators.
Whether CVE-2026-89078, CVE-2026-93577 or CVE-2026-110264 join KEV. Patching to a current release covers all four.
Whether the Ruby team requests its own CVE IDs for the Onigmo fixes. Its advisory says it has not yet, so scanners that track Ruby versions may not flag vulnerable Ruby installs today.
Other products that bundle Ruby and compile user-supplied patterns, which CISA's note explicitly warns about.

This is GitLab's second CVSS 10.0 KEV listing in two months, after the commits API path traversal CVE-2026-85706 in September. Self-managed GitLab now needs the same patch cadence as an edge device.