x.comthreadThreatWire (@ThreatWire_) on X
ThreatWire post on CVE-2026-97229, an integer overflow in the GitLab CI/CD regex compiler. GitLab rates it CVSS 3.1 10.0 and says it can allow unauthenticated code execution under certain conditions, in both CE and EE. Fixes are in 19.2.8, 19.3.5 and 19.4.2 (not 19.3.4), released Oct 12; GitLab-hosted instances are already patched. The post credits joaxcar via HackerOne and says a Rapid7 researcher published a lab PoC on GitHub, which ThreatWire has not run or verified. It also says the CVE is not in CISA KEV and has no known exploitation.
TL;DR GitLab CE/EE CVE-2026-97229 (CVSS 10.0): integer overflow in the CI/CD regex compiler allows unauthenticated RCE; fixed in 19.2.8/19.3.5/19.4.2; lab PoC published, unverified.
Organisations named here
- joaxcar
CVEs named here
- CVE-2026-97229
Technologies named here
- GitLab Dedicated
- GitLab
- Rapid7
Techniques named here
- Integer Overflow
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup