GitLab has issued an emergency patch for a critical vulnerability in its continuous integration and continuous delivery system, rated at the maximum CVSS score of 10.0. The patch was released on 12 October 2026 for versions 19.4.2, 19.3.4 and 19.2.8, and administrators running self-managed installations are urged to update promptly.

What the flaw allows

The vulnerability, tracked as CVE-2026-97229, involves an integer overflow in the CI/CD Regular Expression Compiler. An unauthenticated attacker could execute arbitrary code on a GitLab server by supplying a crafted regular expression in CI/CD configuration. The issue was reported by researcher joaxcar through HackerOne. At disclosure, there were no public reports of exploitation in the wild, and the flaw was not listed in CISA's Known Exploited Vulnerabilities catalogue at that time.

Third regex flaw in a month

The patch is the third regex-engine flaw affecting GitLab in a single month, following two CVSS 9.9 regex bugs patched on 23 September. That pattern underlines why regular-expression handling in build pipelines deserves close attention, because a flaw in how patterns are compiled can have consequences far beyond a single build job. Organisations should check which version they are running, apply the patch for their release line, and confirm the updated version after installation. The practical advice is straightforward: upgrade self-managed installations immediately and do not leave unpatched instances exposed, particularly any instance reachable from outside the organisation. Waiting for a later maintenance window increases the period during which a known maximum-severity flaw remains open. The affected versions are 19.4.2, 19.3.4 and 19.2.8, and the patch was issued on 12 October 2026. No exploit instructions or proof-of-concept detail are included here.

Sources: GitLab advisory (via analysis)