lee1981 (@lee1981b) on X

What it is

CVE-2026-97229 is a critical integer overflow or wraparound (CWE-190) in the CI/CD Regular Expression Compiler of GitLab CE/EE. GitLab says a specially constructed regular expression in CI/CD configuration can lead, "under certain conditions", to arbitrary code execution on the GitLab server itself. The vendor patch release was 12 October 2026, and the CNA record was published on 13 October. The finder is joaxcar, via GitLab's HackerOne program.

The CNA vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0). NVD lists only this GitLab-supplied score, labelled Secondary, so there is no independent NIST scoring. There is no CVSS v4.0 or CISA ADP/SSVC assessment.

Preconditions / Affected

• Affected: 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.
• Self-managed only. GitLab states that GitLab.com is already patched and Dedicated customers need no action. These are vendor statements, not independently tested.
• Source and Helm installs are not exempt. GitLab says an unspecified deployment type includes all supported installation types.
• Helm chart versions differ from application versions. The page's captured mapping is 10.2.8 → 19.2.8, 10.3.6 → 19.3.5 and 10.4.2 → 19.4.2. Chart 10.3.5 maps to 19.3.4, which is not the current target. Check image overrides too.
• A chart label or a downloaded or standby image does not prove what the running service is. Verify the running build on every serving node.

What to do

1. Scope first. Find self-managed CE/EE nodes and their owners, and start with internet-facing instances while accounting for internal reachability.
2. Preserve evidence before or while patching. On Linux-package installs: - Rails logs are under /var/log/gitlab/gitlab-rails/: production_json.log, api_json.log, application_json.log. - Sidekiq logs are at /var/log/gitlab/sidekiq/current. - Source and Helm log locations differ, so confirm them. - Also keep ingress/Workhorse logs, CI configuration revisions and pipeline history.
3. Hunt for server effects using existing EDR/SIEM data: unexplained server-side processes, file writes and egress. Compare against baselines and CI-change context. A search limited to child processes can miss in-process activity.
4. Correlate with correlation_id (and the x-request-id response header). Join on ID, node and bounded UTC time. The page says a shared string is only a candidate join, and that host records may lack request IDs.
5. Upgrade to 19.2.8, 19.3.5 or 19.4.2, or a later patch in the same train, following the official upgrade path including stops and migrations.
6. Verify the running version on every serving node, including background and standby copies. A closed ticket or a runner-only change does not show the server is fixed.
7. If patching must wait, an owner-approved access restriction is only the page author's risk-reduction suggestion. It must be validated against real paths and integrations.

Caveats

• 19.3.4 versus 19.3.5: CERT-EU's initial notice names 19.3.4, but GitLab and the CNA now use 19.3.5. GitLab cites an Ona integration regression in 19.3.4. Target 19.3.5, and the page makes no claim about the security difference between the two.
• The exact trigger route, parameter, expression and conditions are unverified. The linked HackerOne reports are tagged exploit and permissions-required, but returned 403 to the author, so their contents are unknown.
• No verified public working exploit or field exploitation was found. KEV (catalogue dated 8 October, so it predates disclosure) has no match. EPSS returned empty data, meaning unavailable rather than zero.
• No feature-toggle or regex-filter workaround is verified, and the page publishes no CVE-specific IPs, domains or hashes.
• Do not evaluate suspect expressions in an editor, linter or online tester. Preserve them through the authorised evidence process.
• "Changed Scope" is a scoring judgement, not proof of movement between systems. Exposure to server-process permissions does not mean every repository or runner is compromised.
• Patching does not settle earlier integrity. Decisions on credential rotation or rebuild should rest on corroborated unauthorised access, not on the CVSS score.
• The page's helper aids for log projection and version classification were tested only on synthetic fixtures, not against live GitLab.