CISA has added CVE-2026-97229, a critical integer overflow in GitLab Community Edition and Enterprise Edition, to its Known Exploited Vulnerabilities (KEV) catalog. According to the vulnerability description, under certain conditions the flaw could let an unauthenticated attacker run arbitrary code on the GitLab server by supplying a specially crafted regular expression.
What Is It
CVE-2026-97229 is an integer overflow or wraparound vulnerability (CWE-190) in GitLab CE/EE. GitLab does not validate regular expressions in CI/CD configurations closely enough. Under certain conditions, a specially crafted regular expression lets an unauthenticated user execute arbitrary code on the GitLab server.
According to CISA's notes, the root cause is an integer overflow in the Ruby/Onigmo engine that compiles CI/CD regular expressions. CISA warns that other products may be affected by the same underlying issue.
Why It Matters
- Confirmed exploitation: CISA added the CVE to the KEV catalog on 2026-10-29, which confirms active exploitation. CISA's SSVC assessment rates exploitation as active, automatability as yes, and technical impact as total.
- Maximum severity: GitLab gives the flaw a CVSS 3.1 base score of 10.0 (CRITICAL) with vector
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That means it can be exploited over the network, with low complexity, without privileges or user interaction, and its impact reaches beyond the vulnerable component. - Forensic triage required: The KEV entry flags this CVE for forensic triage under CISA's BOD 26-04 implementation guidance.
- Ransomware use: Listed as "Unknown."
What's Vulnerable
GitLab Community Edition and Enterprise Edition:
- 19.2 before 19.2.8
- 19.3 before 19.3.5
- 19.4 before 19.4.2
Patch Status
GitLab has fixed the issue in versions 19.2.8, 19.3.5, and 19.4.2, as described in its 19.4.2 patch release notes.
CISA's required action is to apply mitigations according to the vendor's instructions, following BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. If mitigations are unavailable, follow the BOD 26-04 guidance for cloud services or stop using the product. Organizations are responsible for evaluating each asset's internet exposure. The federal remediation due date is 2026-11-01.
Organizations running other products that use Ruby/Onigmo should review the Ruby project's regexp fix advisory.