Paper/Archive/CVE-2026-97229

CVE-2026-97229

GitLab GitLab — Integer Overflow or Wraparound in GitLab

KEV · added today · due 1 Nov EPSS 18%public exploit SSVC act CVSS 10.0

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 In CISA KEV+3030.0 EPSS percentile 97.2.972 × 2019.4 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Affected

ProductAffectedFixed inSource

GitLab19.2 – < 19.2.819.2.8CNA

GitLab19.3 – < 19.3.519.3.5CNA

GitLab19.4 – < 19.4.219.4.2CNA

Scores by source

GitLab (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refgitlab.com/gitlab-org/gitlab/-/work_items/630686 exploithackerone.com/reports/4055749 exploithackerone.com/reports/4058589 refdocs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-97229 kevcisa.gov/known-exploited-vulnerabilities-catalog