GitLab has warned self-managed customers to patch a maximum-severity vulnerability, CVE-2026-97229, in the regular expression compiler that parses pipeline settings in CI/CD configuration files. The flaw is an integer overflow (CWE-190). According to GitLab’s advisory, under certain conditions an unauthenticated user could execute arbitrary code on the GitLab server by supplying a specially crafted regular expression in a CI/CD configuration, because the expression was not validated sufficiently.
A researcher using the handle joaxcar reported the bug through GitLab’s HackerOne bug bounty program. GitLab.com already runs the patched version and GitLab Dedicated customers need not act. BleepingComputer notes this follows another maximum-severity GitLab bug (CVE-2026-85706) from last month, which CISA added to its known-exploited catalog a day after the fix; the sources reviewed here do not report exploitation of CVE-2026-97229. Our earlier coverage of that flaw is in GitLab CVE-2026-85706 path traversal.
How to check if you’re affected
Affected versions are self-managed GitLab Community Edition (CE) and Enterprise Edition (EE) releases from 19.2 before 19.2.8, from 19.3 before 19.3.4, and from 19.4 before 19.4.2. Check your installed version under Help > GitLab in the web interface (or the Admin Area), and upgrade to 19.2.8, 19.3.4, 19.4.2 or later. GitLab recommends upgrading all self-managed installations immediately. GitLab.com and GitLab Dedicated are not at risk from this bug.