GitLab’s Second Regex Overflow Drops the Login Requirement

GitLab shipped a CVSS 10.0 patch on October 12 for unauthenticated code execution in its CI regex compiler. The bug, CVE-2026-97229, hits self-managed Community Edition and Enterprise Edition servers still on the 19.2, 19.3, or 19.4 branches below the new builds.

GitLab.com is already running the fixed code, and GitLab Dedicated customers have nothing to install. The leftover risk is every self-managed box that took last month’s regex patch and stopped there.

A CVSS 10.0 Overflow in the CI Regex Compiler

GitLab’s October 12 critical patch release names an integer overflow in the CI/CD Regular Expression Compiler. That engine parses, compiles, and evaluates regular expressions that appear in pipeline config files. Weak validation lets a crafted pattern overflow internal bounds and run code on the GitLab host.

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

GitLab, October 12 critical patch notes

GitLab scored the flaw 10.0 on CVSS 3.1 with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Network access is enough. No account is required, and no operator has to click anything. Scope is listed as changed, which is how a compiler bug on the GitLab host is rated as a break of the wider server.

THE OCTOBER 12 FLAW

• CVE ID: CVE-2026-97229, CWE-190, an integer overflow or wraparound in the CI regex compiler.
• Fixed builds: 19.4.2, 19.3.5, and 19.2.8 for CE and EE, including Omnibus, source, and Helm installs.
• Affected lines: all 19.2 releases before 19.2.8, all 19.3 releases before 19.3.5, and all 19.4 releases before 19.4.2.
• Reporter: the researcher GitLab credits as joaxcar, filed through the company’s HackerOne program.

GitLab published 19.3.4 in the same cycle, then warned that 19.3.4 broke merge request pages when the Ona integration was enabled. The 19.3 security target is 19.3.5. CERT-EU’s first advisory, 2026-016, still listed 19.3.4 because it went out the same day as GitLab’s original note.

The company says GitLab.com already runs the patched version and that Dedicated tenants do not need to act. It names no workaround. Self-managed operators are told to upgrade now. CERT-EU added that internet-facing instances should go first.

Nineteen Days After the First Overflow

This is the second integer overflow GitLab has closed in the same compiler since late September, and the first that needs no login. On September 23 GitLab shipped 19.4.1, 19.3.3, and 19.2.7 for two critical regex bugs on September 23, both credited to the same researcher.

CVE-2026-93577 was an integer overflow in the regular-expression compiler, scored 9.9, with privileges required set to low. CVE-2026-89078 was a double-free in the regular-expression parser, also 9.9, with the availability impact marked low. Both needed an authenticated user who could put a crafted regex into a CI/CD config. Both hit the same 19.2, 19.3, and 19.4 lines.

THREE REGEX BUGS, ONE ENGINE

The gap between those releases is 19 days. A server that moved to 19.4.1, 19.3.3, or 19.2.7 closed the authenticated bugs and stayed open to the unauthenticated one. GitLab’s 19.4.2 bug-fix list also adds a Ruby regexp program-size patch and a repeat-range double-free patch for Ruby 3.3 and 3.4, the interpreter bundled in Omnibus packages and cloud-native images.

The researcher behind all three is Johan Carlsson, a full-time bug hunter in Gothenburg who files as joaxcar. GitLab’s notes thank Johan Carlsson on HackerOne for CVE-2026-97229, and the same handle is on both September 23 criticals. Operators who treated 19.4.1 as the end of the regex work now have a second emergency build on the same component.

Self-Managed Servers Still Have to Move

GitLab’s own language splits the fleet in three, and only one of those groups still holds the vulnerable compiler. GitLab.com, the multi-tenant SaaS, is already on the patched code. Dedicated is a single-tenant instance GitLab hosts and updates. Self-managed CE and EE, whether on a laptop, a rack, or a customer Kubernetes cluster, have to take 19.4.2, 19.3.5, or 19.2.8 themselves.

WHO ACTS ON CVE-2026-97229

• Self-managed CE and EE: Upgrade to 19.4.2, 19.3.5, or 19.2.8 on every install type, with internet-facing boxes first.
• GitLab.com: No customer action. GitLab says the SaaS already runs the patched version.
• GitLab Dedicated: No customer action. GitLab applies the patch on the hosted tenant.
• 19.3 operators: Do not stop at 19.3.4. That build broke merge request pages when Ona was on; 19.3.5 is the 19.3 target.

That split matters because the valuable copies of GitLab are often the ones customers refuse to put on GitLab.com. Self-managed is how teams keep source, CI variables, deploy keys, and runner tokens inside their own network. It is also how a development group can run a production GitLab that never appears on a central asset list, which is why a Monday patch can sit unapplied on a box that still holds the company’s release signing material.

GitLab tells investors that more than 50 million registered users and 50 percent of the Fortune 100 use the platform. Those figures mix SaaS seats with self-managed. The CVSS 10.0 score applies to the self-managed compiler, not to a GitLab.com project that GitLab has already moved.

The Three-Day Federal Clock From September

Last month’s GitLab 10.0 bug is the reason this one will not be allowed to age. CVE-2026-85706 was a path-traversal flaw in the repository commits API that let an unauthenticated caller read files off a self-managed server. CISA added it to the Known Exploited Vulnerabilities catalog on September 11 and set a September 14 due date for federal civilian agencies, a three-day window under Binding Operational Directive 26-04.

watchTowr recorded probes against the commits endpoint from 06:00 UTC on September 11, the same day as the KEV listing. Public exploit code followed. One widely copied trick was reading /etc/gitlab/gitlab-secrets.json, which holds the keys GitLab uses to encrypt CI/CD variables, deploy keys, and integration tokens.

CVE-2026-97229 is not on that catalog. Open records still show no public proof of concept. That has not changed the upgrade advice, and it should not, because the last GitLab 10.0 went from patch notes to a federal clock in a day. CISA has listed GitLab bugs in the catalog since 2021, including CVE-2021-22205, an image-parser code-execution flaw later tied to ransomware campaigns against internet-facing GitLab.

THE LAST MONTH ON SELF-MANAGED GITLAB

1. September 11, 2026: CISA adds CVE-2026-85706 to the KEV catalog and sets a September 14 federal due date. Probes against the commits API are already being logged.
2. September 14, 2026: The three-day BOD 26-04 window on CVE-2026-85706 closes for federal civilian agencies.
3. September 23, 2026: GitLab ships 19.4.1, 19.3.3, and 19.2.7 for the authenticated regex compiler overflow and the regex parser double-free.
4. October 12, 2026: GitLab ships 19.4.2, 19.3.5, and 19.2.8 for the unauthenticated compiler overflow. CERT-EU tells EU institutions to start with internet-facing instances.

A self-managed admin who patched in mid-September for the file-read bug, then patched again on September 23 for the authenticated regex RCEs, is still sitting on a compiler that GitLab now rates 10.0 without a login. The KEV catalog is how that fact becomes a three-day order rather than a Wednesday chore.

24 Security Fixes in One Patch Drop

The October 12 builds are not a one-CVE hotfix. GitLab’s table lists 24 security issues: 1 critical, 5 high, 14 medium, and 4 low. CERT-EU counted the same 24. GitLab’s scheduled patches land on the second and fourth Wednesdays of the month. October 12 was a Monday, so this drop was an ad-hoc critical patch, the path GitLab uses when it will not wait for the calendar.

The high-severity row is almost as operational as the critical one. CVE-2026-92883, scored 8.7, is a stored cross-site scripting bug in syntax highlighting that lets an authenticated user run JavaScript in another user’s browser from a crafted repository. CVE-2026-16301, scored 8.5, lets a Developer run pipelines on protected branches through the downstream pipeline creation service. CVE-2026-14814, scored 8.2, is a permissive regex in repository file access that can poison cached raw files and expose protected CI/CD variables.

Two more highs sit in EE-only code. CVE-2026-81839, scored 7.7, is a scheduled pipeline-policy cleanup bug that can run pipelines in a transferred project with the new group’s privileges. CVE-2026-96893, scored 7.3, is an LLM prompt-injection issue in Duo Agent Platform that GitLab’s own Mert Coskuner found internally.

GitLab keeps the detailed issues confidential at release, then opens them on its tracker 90 days after the patch. Until then, the public record is the CVE blurb, the CVSS vector, and the version math. That is enough to upgrade. It is not enough to write a detector that looks for the exact regex, which is why waiting for a published proof of concept is a bad plan on a PR:N compiler bug.

Why Does a CI Regex Compile on the Server?

GitLab evaluates pipeline YAML on the GitLab instance, not only on a runner. Rules, includes, and other CI syntax can carry regular expressions, and those strings are compiled by the same engine that just produced three critical CVEs in 19 days. An unauthenticated trigger means the compiler is reachable without a session under the conditions GitLab described, so the YAML is not just a job script. It is input to a compiler that runs with the GitLab service account.

That is the second-order problem the 10.0 score is capturing. A regex in a pipeline file is supposed to filter branches or match paths. On a vulnerable 19.2, 19.3, or 19.4 server it is also a way to overflow a compiler that GitLab already had to patch in September, then patch again in October, including at the Ruby 3.3 and 3.4 layer in the package. Closing 19.4.1 did not close the unauthenticated path. Closing 19.4.2, 19.3.5, or 19.2.8 does.

Single-node installs will take a maintenance window for the upgrade. Clustered reference architectures have more moving parts and the same compiler. Either way the work is the version bump GitLab already ran on GitLab.com. Dedicated tenants inherit it. Self-managed operators who are still on 19.4.1 are running last month’s regex fix in front of this month’s regex bug.

Frequently Asked Questions

Are GitLab Versions Before 19.2 Affected by CVE-2026-97229?

GitLab’s advisory lists Community Edition and Enterprise Edition from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. It does not list 19.1 or earlier among the impacted versions for this CVE, even though some other bugs in the same October 12 table reach back to 18.7 or 19.1. Operators on 19.1 still need a supported patch line for the rest of the 24-issue drop, but CVE-2026-97229 itself is scoped from 19.2.

What Is GitLab Dedicated, and Do Those Customers Patch?

Dedicated is GitLab’s single-tenant SaaS: GitLab hosts a private instance in a cloud region the customer chooses, with data isolation and residency controls, and a Dedicated for Government path aimed at FedRAMP. GitLab applies the security build. Dedicated notes also describe a typical floor around 1,000 seats and Ultimate-tier security features, which is why those tenants are not in the self-managed upgrade queue for CVE-2026-97229.

When Will GitLab Open the Full CVE-2026-97229 Issue?

GitLab’s patch notes say vulnerability issues are made public on the company’s tracker 90 days after the release that patched them. For the October 12 builds that date falls in January. Until then the public technical record is the CVE text, the CVSS vector, and the version list, plus whatever researchers publish on their own.

Was the October 12 GitLab Patch a Scheduled Release?

No. GitLab’s handbook schedule puts ordinary patch releases on the second and fourth Wednesdays of the month. October 12, 2026 was a Monday, and GitLab labels these builds an ad-hoc critical patch, the track it uses for high-severity fixes that will not wait for that Wednesday cadence. The next scheduled Wednesday after the drop was October 14.

Self-managed admins still on 19.4.1, 19.3.3, or 19.2.7 have the September regex fixes and not the October one. The build that closes CVE-2026-97229 is 19.4.2, 19.3.5, or 19.2.8, and GitLab.com has already taken it.