GitLab CVE-2026-97229: Exploited Regex RCE, Patch Now

On 29 October 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-97229, a critical GitLab flaw, to its Known Exploited Vulnerabilities catalog. Its entry marks the flaw as exploited, and CISA gave US federal agencies until 1 November 2026 to act. GitLab rates the flaw CVSS 10.0. According to the GitLab patch release notes, under certain conditions it could have allowed an unauthenticated user to execute arbitrary code on a GitLab server through a specially crafted regular expression in a CI/CD configuration. If your team runs its own GitLab server, check the version today.

What CVE-2026-97229 is

GitLab describes CVE-2026-97229 as an integer overflow issue in the CI/CD regular expression compiler, caused by insufficient regular expression validation. The bug sits in Onigmo, the regular expression engine inside Ruby, which GitLab is built on. The Ruby core team explains that GitLab compiles regular expressions supplied by its users, such as patterns in CI configuration, and that specially crafted patterns could corrupt memory while Ruby compiles them. GitLab found this could be turned into remote code execution on GitLab servers. The flaw was reported by joaxcar through GitLab's HackerOne bug bounty programme.

CISA's catalogue entry adds a note that other products can potentially be affected by the same underlying Ruby/Onigmo integer overflow. That is why this matters beyond GitLab: see the Ruby section below.

Affected and fixed GitLab versions

GitLab released the fix on 12 October 2026. The 19.4.2 release notes list the affected versions of GitLab Community Edition (CE) and Enterprise Edition (EE):

GitLab says GitLab.com was already running the patched version, and all GitLab Dedicated tenants were patched with an internal release before the patch release was published. Self-managed installations are the ones that need action.

Three related GitLab regex CVEs

The Ruby team links CVE-2026-97229 to three other GitLab CVEs that come from bugs in the same engine. Only CVE-2026-97229 is in the CISA catalogue so far, but the 21 October 2026 releases cover all four:

CVE-2026-110264 has the widest range: GitLab says it affects all versions from 7.0 before 18.11.13, plus each 19.x branch before the fixed release in the table. GitLab backported that fix to 18.11, 19.0, 19.1 and 19.2. So the practical target for a self-managed server is the 21 October 2026 release for your branch, or a later patch, which covers all four CVEs. A server older than 18.11 has no patched release on its branch and needs a full upgrade.

How to check and patch your GitLab server

1. Find your version. Sign in, then in the left sidebar select Help > Help; the version is shown at the top of the page (GitLab docs).
2. Compare it with the tables above. If you are below the 21 October 2026 release for your branch, you are exposed to at least CVE-2026-110264, and to CVE-2026-97229 if you are below 19.2.8, 19.3.5 or 19.4.2 on those branches.
3. Plan the upgrade path. Moving across minor or major versions can involve required upgrade stops, which GitLab lists in its upgrade paths documentation and upgrade path tool.
4. Upgrade, then check for signs of attack. GitLab published six threat detections for CVE-2026-97229 attempts on self-managed instances, including an "Onigmo native worker crash" and "ci regexp guard rejection" signals; the full list is in the release notes. Because CISA lists the flaw as exploited, we also suggest reviewing CI/CD variables, deploy keys and runner tokens stored in GitLab.

That last step matters for ecommerce teams. A self-managed GitLab server often holds the deploy keys, API tokens and environment variables that push code to a live store, so remote code execution on it is a route into production. If you rotate secrets after an exposure, start with anything that can deploy or read customer data.

The Ruby fix: who else is affected

On 23 October 2026 the Ruby core team released Ruby 4.0.9, 3.4.12 and 3.3.13, which fix the Onigmo bugs behind all four GitLab CVEs. Ruby says these bugs are reached only when an application compiles a regular expression from a string an attacker controls, for example by passing it to Regexp.new, Regexp.union or Regexp.compile, or by interpolating it into a regexp literal such as /#{input}/. Applications that only use regular expressions written by their own developers are not affected.

• Timeouts do not help: Ruby says Regexp.timeout does not protect against these bugs.
• Length limits are not reliable either: some of the bugs can be triggered by short patterns.
• Recommended action: upgrade to Ruby 4.0.9, 3.4.12, 3.3.13 or later. If you cannot upgrade, avoid compiling regular expressions from untrusted input.
• No Ruby CVE yet: Ruby has not requested CVE identifiers for these fixes, at least for now, and asks you to track them by the GitLab CVEs in security scanners.

If you run a Ruby application, such as a Rails storefront or a Shopify app built with Ruby, search the code for user-supplied search patterns, filters or validation rules that end up in a regular expression. Run ruby -v on each server and in your container images to see which Ruby version you have, and get patched builds from the Ruby downloads page or your platform. Ruby 3.3 is in its security maintenance phase; Ruby shipped 3.3.13 with these fixes as an exception because GitLab assigned CVEs to issues that rely on them.

The PHP2Shell vulnerability and the Node.js Brotli flaw reached ecommerce stacks the same way, through the runtime under the application, so patch the runtime as well as the application on top of it.