CVE-2026-97229: GitLab CE/EE CI/CD Regex Integer Overflow RCE (pending)

CVE-2026-97229 is an integer-overflow vulnerability in the regular-expression engine GitLab CE/EE uses to compile CI/CD configuration patterns, letting an unauthenticated attacker execute arbitrary code on the GitLab server with a specially crafted regex; it is on CISA's KEV catalog, but NVD's own vulnerability-status field is "Undergoing Analysis" without an NVD-published Primary score, only GitLab's own 10.0 CVSS submission.

CVE-2026-97229 (CWE-190, Integer Overflow or Wraparound) affects GitLab Community Edition and Enterprise Edition. NVD's description states the issue was "remediated in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation" (NVD).

NVD's vulnStatus for this record is "Undergoing Analysis" — NVD has published no independent Primary CVSS score of its own. The only metric on record is GitLab's own CNA-submitted Secondary rating of CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (NVD). So the 10.0 figure is a CNA Secondary score, not an NVD-confirmed Primary score.

GitLab's patch release notes confirm the fixed versions above, state that GitLab.com and GitLab Dedicated were already patched before public disclosure, and that GitLab additionally shipped six new threat-detection rules for self-managed instances to help identify exploitation attempts against this flaw. No workaround short of upgrading is documented (GitLab Patch Release: 19.4.2, 19.3.5, 19.2.8).

The underlying root cause traces to the Ruby/Onigmo regular-expression engine itself: Ruby's own security announcement describes "an integer overflow in the size of a compiled pattern" in the Onigmo regex compiler (fixed upstream by Ruby pull request #19020), affecting Ruby before 4.0.9, 3.4.12 and 3.3.13, and warns that "Regexp.timeout does not protect against these bugs" for any application — not just GitLab — that compiles regular expressions built from untrusted input via Regexp.new, Regexp.union, or string interpolation; the announcement groups CVE-2026-97229 together with the related CVE-2026-93577 as sharing the same fix (Ruby: Regexp fixes for GitLab CVEs).

CISA added CVE-2026-97229 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-29, with a required-action due date of 2026-11-01 and forensic-triage flagged "Yes" under BOD 26-04; known ransomware campaign use is listed as "Unknown." CISA's catalog notes flag that other products may share the same underlying Ruby/Onigmo issue (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.18427 (97.229th percentile) — notably high for a two-week-old CVE, consistent with its unauthenticated-RCE profile and active KEV listing (FIRST EPSS).

Until NVD completes its own analysis, treat the 10.0 figure as indicative only, not NVD-confirmed. Any self-managed GitLab CE/EE instance on an affected 19.2.x, 19.3.x or 19.4.x build should be upgraded immediately regardless of network exposure, since the flaw requires no credentials.

• An integer overflow in the regex compiler used by GitLab CE/EE's CI/CD configuration parser lets an unauthenticated attacker execute arbitrary code on the server via a crafted regular expression; affects 19.2.0-19.2.7, 19.3.0-19.3.4, 19.4.0-19.4.1. — NVD
• CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — GitLab's own CNA Secondary rating; NVD's vulnStatus is "Undergoing Analysis" and NVD has not published its own Primary score. — NVD
• Fixed in GitLab CE/EE 19.2.8, 19.3.5 and 19.4.2; GitLab.com and Dedicated were already patched; six new threat-detection rules shipped for self-managed instances; no workaround short of upgrading. — GitLab Patch Release: 19.4.2, 19.3.5, 19.2.8
• Root cause is an integer overflow in the size of a compiled pattern in the Onigmo regex engine used by Ruby; fixed upstream in Ruby 4.0.9, 3.4.12 and 3.3.13; Regexp.timeout does not mitigate it; CVE-2026-93577 shares the same fix. — Ruby: Regexp fixes for GitLab CVEs
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-29, forensic-triage required under BOD 26-04, required-action due date 2026-11-01. — CISA KEV
• EPSS score is 0.18427 (97.229th percentile) as of 2026-10-29. — FIRST EPSS