GitLab Patches Maximum-Severity Flaw; CISA Says It Is Exploited

What happened

On October 12, 2026, GitLab released versions 19.4.2, 19.3.5 and 19.2.8 to fix CVE-2026-97229, according to Rapid7. Rapid7 describes it as an integer overflow, a calculation error, in the way GitLab handles regular expressions (text-matching patterns) in its CI/CD configuration, the files that automate building and testing software. ^[3][4][5]

Rapid7 says that under certain conditions a remote attacker can run code on a GitLab server through a specially crafted regular expression stored in a malicious CI/CD configuration. The issue was reported through HackerOne by a researcher named joaxcar, according to Rapid7. ^[3][4]

Severity and affected versions

GitLab assigned the flaw a CVSS severity score of 10.0, the maximum, and NVD lists the same score. Rapid7 says the vendor score implies exploitation without logging in, and notes that GitLab says all deployment types are affected unless stated otherwise. It lists GitLab Community Edition and Enterprise Edition from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2 as affected. Rapid7 says GitLab.com was patched before disclosure. ^[3][4]

Exploitation

CISA added the flaw on October 29 to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, citing evidence of active exploitation. The Canadian Centre for Cyber Security updated its GitLab advisory the same day to note the listing. ^[1][2]

The Hacker News reports that an attacker tried to exploit the flaw on the Alpine Linux project's own GitLab server about a week after the fix was released, according to Alpine Linux, which said so on October 28. Alpine found no evidence that the attack worked, according to the report. ^[6]

What is not yet known

The coverage reviewed does not say how widespread exploitation is or who is behind it. Rapid7 notes the vendor's score and its own reproduction of the flaw may differ on whether authentication is needed. ^[3][1]