GitLab released a critical patch on 12 October 2026 for an integer overflow in the CI/CD regular expression compiler. Under the conditions GitLab describes, an unauthenticated user can run arbitrary code on the server with a crafted regular expression in a CI/CD configuration.
What happened
The flaw is CVE-2026-97229. GitLab scores it CVSS 10.0, with a network vector, no privileges, and no user interaction. CERT-EU published advisory 2026-016 the same day and told operators to start with internet-facing instances.
GitLab.com is already on the patched build. GitLab Dedicated customers do not need to act. Self-managed Community Edition and Enterprise Edition do.
Who is affected
GitLab CE and EE versions from 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. Omnibus, source, and Helm installs are in scope unless a deployment type is called out separately. GitLab also notes a known bug in 19.3.4 that affects merge request pages when the Ona integration is enabled, with a fix expected in 19.3.5.
What to do now
Upgrade self-managed GitLab to 19.4.2, 19.3.4, or 19.2.8 today, starting with anything reachable from the internet. Do not wait for a public proof of concept. GitLab and CERT-EU have not said the flaw is being exploited, but the score and the unauthenticated path make delay a bad trade.
- Confirm the running version on every self-managed instance, including forgotten CI hosts and client project servers.
- If you are on 19.3 and use the Ona integration, plan for the merge-request page bug until 19.3.5, or move to 19.4.2.
- Treat pipeline configuration as untrusted input until the upgrade is done. Restrict who can push CI config on exposed projects.
Source: GitLab critical patch release for 19.4.2, 19.3.4, and 19.2.8, published 12 October 2026. Read the advisory.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.