GitLab fixes max-severity code execution flaw in its CI/CD regex compiler
Self-managed GitLab users need to upgrade now to close a flaw that could let an unauthenticated attacker run code on their servers.
GitLab has shipped emergency fixes for a maximum-severity flaw in its CI/CD Regular Expression Compiler that could let an unauthenticated attacker execute code on affected servers, so self-managed operators need to upgrade right away. The bug is tracked as CVE-2026-97229 and came from an integer overflow in the component that parses and evaluates regular expressions in pipeline configuration files. GitLab says the patch is in CE and EE releases 19.2.8, 19.3.4, and 19.4.2, covering prior 19.2, 19.3, and 19.4 builds. The issue was reported through GitLab’s HackerOne program by a researcher using the handle joaxcar. GitLab also says GitLab.com is already fixed, while GitLab Dedicated customers do not need to do anything.
Why it matters
For self-managed operators, the issue turns ordinary pipeline configuration into a path to server compromise if left unpatched. GitLab.com is already covered, and GitLab Dedicated customers do not need to act, so the immediate impact falls on installations they run themselves.
Keep or strike?
Does this story matter, or is it hype? Mark it before you see what everyone else did.
Sources
- BleepingComputer