CVE-2026-97229 GitLab: exploited CI/CD regex RCE, CVSS 10

Update, Nov 2: CISA’s federal deadline passed on Nov 1, and plenty of servers missed it. On Nov 1, Shadowserver said it was tracking more than 1,000 GitLab instances still vulnerable to CVE-2026-97229, and more than 11,300 vulnerable to CVE-2026-110264, a separate maximum-severity regex-compiler bug GitLab fixed last month, out of about 39,000 instances it sees daily. CVE-2026-110264 isn’t in CISA’s KEV catalog. If you’re upgrading anyway, go to the newest patch release for your branch, not the minimum. (BleepingComputer (opens in a new tab))

Call: Patch now. CVE-2026-97229 is exploited. CISA added it to its Known Exploited Vulnerabilities catalog on Oct 29 and gave federal agencies until Nov 1, along with an order to do forensic triage, not just patch. GitLab rates it CVSS 10.0. A crafted regular expression in a CI/CD configuration can let an unauthenticated attacker run code on the GitLab server. GitLab fixed it on Oct 12, so if you run self-managed GitLab and haven’t patched since then, assume someone has tried this.

What breaks: GitLab calls it an integer overflow in the CI/CD regular expression compiler, caused by “insufficient regular expression validation.” The underlying bug is in Onigmo, Ruby’s regex engine, and Ruby shipped its own fixes on Oct 23. Rapid7 has published a proof of concept. Its version needs push access to a public project, so an instance with open sign-up or public projects is the easiest target.

Who’s hit: Self-managed GitLab CE and EE, every version from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab.com and GitLab Dedicated are already patched. Alpine Linux says attackers tried it against its GitLab instance on Oct 20-21. Alpine took the instance down, then brought it back Oct 29-30 on a patched release with the fixed Ruby.

What to do:

Upgrade to 19.4.2, 19.3.5 or 19.2.8 or later. Not 19.3.4: Alpine found the fix wasn’t in it.
Run GitLab from source on your own Ruby? Ruby’s Oct 23 releases fix the underlying regex-engine bug. Upgrade to 3.3.13, 3.4.12 or 4.0.9 as well.
Look for signs someone tried. GitLab published six detections for self-managed instances: “Onigmo native worker crash”, “Graphql cilint hostile regexp”, “ci regexp oversized non ascii path”, “ci regexp guard rejection”, “ci lint workhorse worker crash” and “ci lint scripted client error burst.” The names point at worker crashes and odd CI lint and GraphQL traffic, so start there in your logs.
If it was exposed and unpatched: treat the server as a credential store. Rotate runner registration tokens, CI/CD variables, deploy keys and access tokens after you’ve checked for compromise.

Sources: GitLab 19.4.2 release (opens in a new tab), CISA KEV, Oct 29 (opens in a new tab), Ruby regex fixes (opens in a new tab), Alpine Linux incident report (opens in a new tab), BleepingComputer (opens in a new tab).

CVE-2026-97229 GitLab: exploited CI/CD regex RCE, CVSS 10

Sources

More from October 2026 patch cycle