GitLab Patches a Max-Severity Regex Flaw Alongside Five High-Severity Bugs
The flaw in GitLab’s CI/CD Regular Expression Compiler could let unauthenticated attackers execute arbitrary code, and users are urged to patch immediately.
- On Monday, GitLab patched a maximum-severity vulnerability, CVE-2026-97229, in its CI/CD Regular Expression Compiler that could allow unauthenticated attackers to execute arbitrary code on vulnerable servers.
- The flaw stems from an integer overflow weakness in the CI/CD Regular Expression Compiler, affecting GitLab Community Edition and Enterprise Edition versions 19.2, 19.3, and 19.4 before patched releases.
- Security researcher 'joaxcar' reported the vulnerability via HackerOne; the platform supports over 30 million registered users and more than 50% of Fortune 100 companies including Nvidia, T-Mobile, Lockheed Martin, Airbus, and Goldman Sachs.
- Cloud-Hosted instances remain safe, as GitLab has already upgraded its own servers; the Cybersecurity and Infrastructure Security Agency has flagged five GitLab flaws since 2021.
- CVE-2026-97229 is the latest in a string of vulnerabilities addressed in recent months, following CVE-2026-85706, a maximum-severity flaw GitLab patched last month.
13 Articles
13 Articles
GitLab patches a max-severity regex flaw alongside five high-severity bugs
GitLab just fixed a max-severity vulnerability that could allow unauthenticated attackers to execute arbitrary code on its servers. The company released a fix on Monday, alongside patches for five other high-severity flaws affecting its source code management and continuous integration and delivery (CI/CD) platform. The vulnerability, tracked as CVE-2026-97229, was fixed in versions 19.4.2, 19.3.5, and 19.2.8 of its Community Edition (CE) and En…
BleepingComputer
IT Security News - cybersecurity, infosecurity newsGitLab warns of max severity code execution vulnerability
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances.
A critical security failure in GitLab, identified as CVE-2026-97229 and classified with CVSS 10.0 score, alerts system administrators, developers and DevSecOps teams. The problem may allow an invader to remotely execute code in a vulnerable instance without needing to log in, creating risks for repositories, automation processes and services connected to the platform. The security update published by GitLab on October 12, 2026 also corrects othe…
GitLab fixes a fault noted 10 out of 10 that would allow, without an account, to execute code on the server via a trapped regex. The third CVE of the kind in three weeks: here are the versions to install.
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
