CVE-2026-97229: CISA says GitLab max-severity RCE is exploited, patch to 19.4.2

CISA added GitLab's CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog on 29 October 2026, confirming that attackers are using the maximum-severity remote code execution flaw against unpatched servers. The federal deadline in the catalog entry is 1 November, which is today. If you run your own GitLab and are still on a release older than 19.4.2, 19.3.5 or 19.2.8, treat the server as a target now, and check whether your Ruby is patched too.

Key points

• CVE-2026-97229 is an integer overflow (CWE-190) in GitLab's CI/CD regular expression compiler, scored CVSS 10.0, that lets an unauthenticated attacker run code on the server through a crafted regular expression in a CI/CD configuration (GitLab advisory).
• GitLab fixed it on 12 October 2026 in 19.4.2, 19.3.5 and 19.2.8; affected are all versions from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2.
• CISA added the flaw to the KEV catalog on 29 October 2026 with a due date of 1 November 2026 under its directive BOD 26-04; the catalog lists known ransomware use as "Unknown".
• The root cause is a bug in Onigmo, Ruby's regular expression engine; GitLab patched the Ruby it bundles, and upstream Ruby shipped fixes on 23 October in 4.0.9, 3.4.12 and 3.3.13.
• Self-built GitLab installs and custom container images need a patched Ruby as well as a new GitLab version, as Alpine Linux found when upgrading GitLab alone did not close the hole.

What to do

Who is affected. Self-managed GitLab Community Edition and Enterprise Edition, versions 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. GitLab says GitLab.com and GitLab Dedicated are already patched.

Fix. Upgrade to 19.4.2, 19.3.5 or 19.2.8, or any later release. GitLab's patch notice says 19.3.4 had a separate bug affecting merge request pages when the Ona integration was enabled, which 19.3.5 fixes, so do not stop at 19.3.4.

If you build GitLab yourself or run a custom image. GitLab's fix lives in a patch to the Ruby that GitLab ships in its official packages and images. Upgrading the application alone does not apply it if you supply your own Ruby. Use Ruby 4.0.9, 3.4.12 or 3.3.13 or later, which contain the upstream fixes.

Check for signs of attack. GitLab released six threat detections for self-managed instances. Their names describe what to look for: Onigmo native worker crash, Graphql cilint hostile regexp, ci regexp oversized non ascii path, ci regexp guard rejection, ci lint workhorse worker crash and ci lint scripted client error burst. Repeated worker crashes around CI lint requests are the pattern Alpine saw (below).

If you cannot patch today. We found no workaround in GitLab's advisory text. CISA's catalog entry tells operators to apply mitigations following the vendor's instructions, or discontinue use of the product if mitigations are unavailable. At minimum, restrict who can register accounts and reach CI configuration endpoints, and treat any instance that crashed workers on crafted input as potentially compromised.

What happened

GitLab published a critical patch release on 12 October 2026 containing versions 19.4.2, 19.3.5 and 19.2.8. Among the security fixes, one was rated Critical: "Integer Overflow issue in CI/CD Regular Expression Compiler", tracked as CVE-2026-97229. GitLab's description says that under certain conditions an unauthenticated user could execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, because the expression was not validated sufficiently. The score is CVSS 10.0 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, meaning network reachable, low complexity, no privileges and no user interaction. GitLab credited a researcher using the handle joaxcar, who reported it through the company's HackerOne bug bounty programme.

On 29 October 2026 CISA added the vulnerability to the KEV catalog. The entry is named "GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability" and sets 1 November 2026 as the due date. It also marks forensic triage as "Yes" and cites CISA's Forensics Triage Requirements, so agencies are expected to look for signs of earlier compromise, not only to patch. The notes field warns that other products could be affected by the same underlying Ruby/Onigmo integer overflow, and points to the Ruby advisory. BleepingComputer, reporting on 30 October, said attackers had started exploiting the flaw and that Shadowserver tracks nearly 2,800 internet-exposed GitLab Community Edition instances; the article did not say how many of those are patched, and we could not find a per-version breakdown from Shadowserver itself.

CISA's directive binds only US federal civilian agencies. The catalog is nonetheless widely used as a public list of what to patch first, because inclusion requires evidence of exploitation in the wild.

Background

The CVE is one of four that GitLab has assigned to memory-safety problems in Ruby's regular expression compiler within weeks, according to the Ruby project's advisory of 23 October 2026:

GitLab CVE	Flaw	Fixed in GitLab
CVE-2026-89078	Double free in the regular expression parser	19.4.1
CVE-2026-93577	Integer overflow in the regular expression compiler	19.4.1
CVE-2026-97229	Integer overflow in the CI/CD regular expression compiler	19.4.2
CVE-2026-110264	Integer overflow in the regular expression compiler (overflow of internal IDs in a pattern with many repeats)	19.5.1

Ruby says CVE-2026-93577 and CVE-2026-97229 come from the same upstream bug, an integer overflow in the size of a compiled pattern, fixed in Ruby 4.0.8, 3.4.12 and 3.3.13. The 110264 fix landed in Ruby 4.0.9. We covered that later GitLab release in GitLab patches CVE-2026-110264.

GitLab compiles regular expressions that users supply, for example patterns in CI configuration, with Ruby's Regexp.new. The Ruby advisory says GitLab found that specially crafted patterns could corrupt memory during compilation and that this could be turned into remote code execution. Ruby's note that GitLab "addressed these issues in its own releases by patching the Ruby it ships" is the detail that trips up operators who assemble their own images.

GitLab has a record in the KEV catalog. BleepingComputer counts six GitLab vulnerabilities flagged as exploited since November 2021, including CVE-2026-85706, a path traversal flaw in the repository commits API that CISA listed in September 2026.

How it works

Regular expressions in a CI configuration are text a user controls, and GitLab's server compiles them with Ruby. Ruby's advisory describes the underlying bugs as an integer overflow in the size of a compiled pattern (behind CVE-2026-93577 and CVE-2026-97229) and an overflow of internal IDs in a pattern with many repeats (behind CVE-2026-110264). GitLab found that crafted patterns could corrupt memory while Ruby compiles them, and that this could be turned into remote code execution. None of the sources we read publishes exploit details, so the exact corruption mechanics are not public in what we found, and we do not guess at them here.

The Ruby project is explicit about who is exposed: these bugs are reached only when an application compiles a regular expression from a string an attacker controls, through Regexp.new, Regexp.union, Regexp.compile or interpolation into a literal such as /#{input}/. Applications that only use patterns written by their developers are not affected. Two common defences do not help: Regexp.timeout does not protect against these bugs, and limiting pattern length "does not reliably protect against them either", because some can be triggered by short patterns.

What it means

For GitLab administrators, the order of work is patch, then verify Ruby, then hunt. The Alpine case shows the verification step is not optional. Alpine Linux reported that on 20 and 21 October a newly registered account sent crafted CI configurations to its GitLab instance, which was still on 19.3.4 without the 12 October fix. Worker processes crashed 8 times; in 4 of those the attacker got partway through the exploit and failed at the next step. The attacker also downloaded Alpine's GitLab container image, which Alpine said suggests the exploit was being tuned to its exact build. Alpine found no evidence code ran on the server, but could not rule it out, so it rebuilt the instance from scratch and reset all passwords. It also found that upgrading to 19.3.6 on 22 October did not fix the problem because its image used standard Ruby. Its image published on 27 October contains Ruby 3.3.13. We told that story in the Alpine incident write-up.

For developers of other Ruby applications, the Ruby advisory is a prompt to audit any place a user-supplied string reaches Regexp.new. Ruby says it has not requested CVE identifiers for these fixes in Ruby itself, at least for now, because it has long considered compiling untrusted patterns unsafe, and its documentation currently discusses untrusted patterns only as a denial-of-service risk. The practical reading is that you should not wait for a CVE against your own app to remove the pattern.

For security teams, the sequence is a useful data point on timing. The fix shipped on 12 October, the first known attack on Alpine came on 20 October, and the catalog entry followed on 29 October. Eight days passed between patch and the attack described by Alpine.

What we don't know yet

• How many internet-exposed GitLab servers are still unpatched. Shadowserver's figure of nearly 2,800 exposed Community Edition instances, as reported by BleepingComputer, is a count of exposure, not of vulnerability.
• Who is exploiting it, and for what. CISA lists known ransomware campaign use as "Unknown", and we found no attribution in the sources we read.
• Whether a public exploit exists. Secondary sources disagree on this and we could not confirm either way from a primary source, so we are not relying on any.
• Whether other products embedding Onigmo are affected, as CISA's note suggests is possible. No other vendor advisory was found.

What to watch next

• Whether CISA's known ransomware use field changes from "Unknown".
• Ruby releases after 4.0.9 and any change to the Regexp documentation about untrusted patterns.
• GitLab's own disclosure: GitLab says it makes the issues behind security fixes public 90 days after the release, which for the 12 October release is around 10 January 2027.
• Further GitLab patch releases: CVE-2026-110264 was fixed in 19.5.1, so 19.5.x is the line to be on if you can move.

Sources

• CISA Known Exploited Vulnerabilities catalog (JSON feed), entry for CVE-2026-97229
• GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8
• Ruby: Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264
• Alpine Linux: GitLab security incident: attempted exploitation of CVE-2026-97229
• BleepingComputer: CISA says max severity GitLab flaw now exploited in the wild