Description

The primary root cause of the vulnerability is the regular expression processing mechanism within GitLab's CI/CD system—specifically, an integer overflow flaw occurring during regex compilation. The lack of proper validation for regular expressions allows attackers to submit specially crafted payloads via CI/CD configurations to trigger malicious code execution.

  • CVSS Score: 10.0

  • Severity: Critical

  • CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scope of Impact

This vulnerability affects both GitLab Community Edition (GitLab CE) and GitLab Enterprise Edition (GitLab EE). System administrators must review and upgrade immediately to minimize the risk of exploitation. Versions requiring updates include:

  • Version 19.2: Upgrade to version 19.2.8 or higher.

  • Version 19.3: Upgrade to version 19.3.4 or higher.

  • Version 19.4: Upgrade to version 19.4.2 or higher.

Note regarding version 19.3.4: GitLab has identified a regression affecting merge requests when the Ona integration is enabled. If you are using this feature, administrators should implement compensating security controls for CVE-2026-97229 while awaiting the official 19.3.5 patch.

Impact

Successful exploitation of the vulnerability can lead to:

  • Arbitrary code execution on the GitLab server without authentication.

  • Direct access to source code, CI/CD variables, tokens, secrets, and credentials stored on GitLab.

  • Full server compromise, infection of GitLab Runners and related infrastructure, and pipeline manipulation leading to supply chain attacks.

Mitigation

  • Immediately upgrade self-managed GitLab CE/EE to version 19.4.2, 19.3.4, or 19.2.8 (or higher). Note that these patches include database migrations: single-node systems will experience downtime, whereas multi-node systems should utilize zero-downtime upgrade procedures.

  • Restrict internet access to the GitLab instance (via VPN or IP allowlists) until the patch update is fully completed.

  • Review logs and abnormal changes in CI/CD configurations (.gitlab-ci.yml, regex rules/only/except) as well as unfamiliar processes on the server; rotate secrets and tokens if compromise is suspected.

References

https://adsecvn.com/bai-viet/lo-hong-nghiem-trong-cve-2026-97229-trong-gitlab-nguy-co-rce-khong-can-xac-thuc

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/

https://nvd.nist.gov/vuln/detail/cve-2026-97229

https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/