Story perspectives

GitLab Issues Emergency Patches for CVE-2026-97229 RCE

By Drooid · Oct 12, 2026, 10:41 PM UTC · How we work

Summary

Story summary

GitLab released emergency patches that fix the critical CVE-2026-97229 remote-code execution flaw.
The integer-overflow flaw in the CI/CD regex compiler scores a CVSS 10.0.
It affects Community and Enterprise editions from version 19.1 and is fixed in 19.4.2, 19.3.4, and 19.2.8.
GitLab urged all self-managed installations to upgrade immediately, noting GitLab.com and Dedicated customers are already protected.
GitLab credited researcher joaxcar for reporting the issue via its HackerOne bug bounty program.

1 of 1

Story summary

GitLab released emergency patches that fix the critical CVE-2026-97229 remote-code execution flaw.
The integer-overflow flaw in the CI/CD regex compiler scores a CVSS 10.0.
It affects Community and Enterprise editions from version 19.1 and is fixed in 19.4.2, 19.3.4, and 19.2.8.
GitLab urged all self-managed installations to upgrade immediately, noting GitLab.com and Dedicated customers are already protected.
GitLab credited researcher joaxcar for reporting the issue via its HackerOne bug bounty program.