Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
MentionsGitLab
Overview On October 12, 2026, GitLab released 19.4.2 , 19.3.5 , and 19.2.8 to fix CVE-2026-97229 , an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar . GitLab assigned it a CVSS score of 10.0 and described possible code execution by an unauthenticated user.
Summary from Rapid7 Blog.
Explained
The technology and terms in this story. Learn more
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptProof of conceptA demonstration that a flaw can be exploited, usually published by researchers.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.