Summary

CVE-2026-97229 is a newly published vulnerability in GitLab CE/EE that could allow an unauthenticated user to execute arbitrary code on a GitLab server through a specially crafted regular expression in a CI/CD configuration due to insufficient regular expression validation. The CVE record states this may occur "under certain conditions"; those conditions have not been made public at this time. No exploitation, proof-of-concept, or CISA KEV evidence has yet been identified.

Affected Systems and Applications

GitLab CE/EE (self-managed) versions affected:

• 19.2.0 through 19.2.7 (fixed in 19.2.8)
• 19.3.0 through 19.3.4 (fixed in 19.3.5)
• 19.4.0 through 19.4.1 (fixed in 19.4.2)

Technical Details

Vulnerability Mechanism

The vulnerability stems from an integer overflow weakness within GitLab's CI/CD regular expression compiler. This compiler parses, compiles, and evaluates regular expressions in a given project's configuration files.

An integer overflow occurs when a calculation produces a value that exceeds the storage capacity of the integer type used by the application. This often happens when an integer value is incremented beyond its maximum supported size. The resulting condition can lead to undefined behavior, application crashes, memory corruption, improper resource allocation, or buffer overflows. In some cases, these conditions can be leveraged to achieve arbitrary code execution.

Mitigation

Immediate Actions for Self-Hosted Instances

Limit Exposure

Reduce network exposure of self-managed GitLab instances that have not yet been upgraded. Examples include limiting access to trusted networks or requiring VPN connectivity until patches are applied.

Patch and Upgrade

Upgrade affected systems to one of the following versions or later:

• 19.2.8
• 19.3.5
• 19.4.2

What the Cyber Fusion Center Is Doing

The CFC is monitoring the situation and analyzing the case to identify potential threat-hunting campaigns. This advisory will be updated if required.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-97229
• CVE: https://cveawg.mitre.org/api/cve/CVE-2026-97229
• GitLab Patch Release: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/