Is CVE-2026-97229 exploited in the wild?

Yes. CVE-2026-97229 is known to be exploited in the wild, first recorded on 29 October 2026. Treat it as urgent.

How severe is CVE-2026-97229?

Critical severity, with a CVSS score of 10, published 13 October 2026.

Which products and versions are affected?

GitLab CE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2; GitLab EE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2.

Is there a fix for CVE-2026-97229?

Yes: fixed in GitLab CE/EE 19.2.8, 19.3.5, 19.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97229 attacked?

It is attacked over the network.

Am I affected by CVE-2026-97229?

Check whether you run GitLab Community Edition, GitLab Enterprise Edition, GitLab or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97229: GitLab CE/EE integer overflow in CI/CD regular expression compiler

CVE-2026-97229 · Severity: critical · CVSS 10 · Exploited in the wild · Published 2026-10-13

GitLab is a code hosting and CI/CD platform used by development teams. An integer overflow vulnerability in GitLab's CI/CD pipeline configuration processor allows an unauthenticated attacker to execute arbitrary code on the server by uploading a malicious regular expression pattern. This could lead to complete compromise of the GitLab instance, exposing all source code, secrets, and data stored within.

Technologies: GitLab Community Edition, GitLab Enterprise Edition, GitLab. Vendors: GitLab.

Quick answers

Is CVE-2026-97229 exploited in the wild?: Yes. CVE-2026-97229 is known to be exploited in the wild, first recorded on 29 October 2026. Treat it as urgent.
How severe is CVE-2026-97229?: Critical severity, with a CVSS score of 10, published 13 October 2026.
Which products and versions are affected?: GitLab CE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2; GitLab EE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2.
Is there a fix for CVE-2026-97229?: Yes: fixed in GitLab CE/EE 19.2.8, 19.3.5, 19.4.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97229 attacked?: It is attacked over the network.
Am I affected by CVE-2026-97229?: Check whether you run GitLab Community Edition, GitLab Enterprise Edition, GitLab or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: GitLab CE/EE 19.2.8, 19.3.5, 19.4.2

Technical details

An integer overflow in the CI/CD regular expression compiler allows unauthenticated remote code execution via a specially crafted regex in a CI/CD configuration file. The vulnerability stems from insufficient validation of regular expressions before compilation. Exploitation requires no authentication, no user interaction, and results in arbitrary code execution with full server privileges.

Affected products

GitLab GitLab CE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2
GitLab GitLab EE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2

Timeline

2026-10-13: disclosed
2026-10-12: patched: Versions 19.4.2, 19.3.5, 19.2.8 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.