GitLab Fixes Critical CVE-2026-97229 Flaw Rated CVSS 10

GitLab CVE-2026-97229 is a critical vulnerability with the maximum CVSS score of 10.0, for which the vendor released fixed versions of its software on October 12, 2026. The flaw affects self-managed deployments of both GitLab Community Edition and Enterprise Edition and, under certain conditions, could allow an unauthenticated attacker to execute arbitrary code on the server.

GitLab recommends that administrators immediately update to version 19.4.2, 19.3.5, or 19.2.8, depending on the branch in use. Internet-facing instances have priority, according to a CERT-EU security advisory.

GitLab CVE-2026-97229: flaw in regular expression processing

The vulnerability identified as CVE-2026-97229 is an integer overflow in the CI/CD Regular Expression Compiler component. GitLab said that a specially crafted regular expression in a CI/CD configuration could, under certain circumstances, lead to arbitrary code execution on the server without requiring attacker authentication.

The flaw affects GitLab 19.2 branches before version 19.2.8, 19.3 branches before version 19.3.5, and 19.4 branches before version 19.4.2. It affects Community Edition and Enterprise Edition in self-managed deployments, meaning instances managed by the organizations themselves.

GitLab.com is already using a fixed version, according to the vendor. GitLab Dedicated customers do not need to take any action.

Deploy version 19.3.5, not the originally listed 19.3.4

When updating the 19.3 branch, it is important to use release 19.3.5. GitLab originally listed version 19.3.4, but it contained an issue when the Ona integration was enabled. The vendor therefore replaced it with version 19.3.5 as the final fixed release.

Administrators should verify which branch they operate and update to the corresponding security version:

• GitLab 19.4 to 19.4.2 or later,
• GitLab 19.3 to 19.3.5 or later,
• GitLab 19.2 to 19.2.8 or later.

The release contains a total of 24 security fixes. In its advisory, CERT-EU specifically called for internet-exposed GitLab instances to be updated first.

High risk for servers containing source code and CI/CD

CVSS 10.0 is the highest possible severity rating. In this case, it is mainly increased by the combination of network accessibility, the absence of a required login, and the possibility of remote code execution if successfully exploited.

Self-managed GitLab servers commonly process source code, repositories, and automated build or deployment configurations. GitLab and CERT-EU therefore recommend deploying the fix without delay, especially if the administrative interface or instance is accessible from the internet.

Available materials do not confirm that CVE-2026-97229 is already being actively exploited in the wild. There is also no known data on the number of vulnerable instances or specific organizations that have been attacked.

What to monitor after the fix is released

Further developments may bring confirmation or refutation of active exploitation from GitLab, CISA, or other security authorities. Technical details or exploits may also be disclosed after GitLab’s fixed issues become available.

For administrators, the immediate priority is checking the version and updating. For the 19.3 branch, note that the correct target version is 19.3.5, not 19.3.4.

Verified and updated: October 13, 2026 06:21