# GitLab CE/EE max-severity unauthenticated code execution flaw in CI/CD Regular Expression Compiler (CVE-2026-97229)

> GitLab disclosed CVE-2026-97229 (CVSS 10.0), an integer overflow in the CI/CD Regular Expression Compiler that could let an unauthenticated user execute arbitrary code on the GitLab server via a crafted regular expression in a CI/CD configuration. Fixed in GitLab CE/EE 19.2.8, 19.3.4 and 19.4.2; GitLab.com is already patched and self-managed instances need immediate action.

- **Published:** 2026-10-12T13:29:06Z
- **Last reviewed:** 2026-10-12T13:29:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3356
- **ID:** TL-2026-3356
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-97229, CVE-2026-93577, CVE-2026-89078, CVE-2026-85706

## Description

CVE-2026-97229 is an integer overflow (CWE-190) in the regular expression compiler that GitLab uses to parse, compile and evaluate regular expressions found in projects' CI/CD pipeline configuration files. GitLab's advisory states that, under certain conditions and due to insufficient regular expression validation, an unauthenticated user could execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration. GitLab scores the issue CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Affected versions are GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.4 and 19.4 before 19.4.2. The flaw was reported by the researcher 'joaxcar' through GitLab's HackerOne bug bounty program. The GitLab advisory does not list a CWE; CWE-190 is derived from the advisory title (integer overflow).

The fix shipped in patch release 19.4.2 (together with 19.3.4 and 19.2.8), which addresses 25 security vulnerabilities in total (CVE-2026-97229 plus 24 others ranging from low to high severity, including XSS, authorization and SSRF issues). GitLab.com and GitLab Dedicated are already patched. Single-node self-managed instances will see downtime during the upgrade; multi-node instances can apply the patch with zero-downtime procedures. At the time of the BleepingComputer report (2026-10-12) there was no reported active exploitation, no public proof-of-concept and no published indicators of compromise; the NVD API returned no record for the CVE at research time.

This appears closely related to an earlier fix: CVE-2026-93577, published with patch release 19.4.1/19.3.3/19.2.7 on 2026-09-23, is also an integer overflow in the same Regular Expression Compiler, reported by the same researcher, with CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) requiring an authenticated user. The same release also fixed CVE-2026-89078, a double free in the Regular Expression Parser (CVSS 9.9, authenticated, reported by joaxcar); that release fixed 11 vulnerabilities in total. Sources do not state that CVE-2026-97229 is a bypass or incomplete fix of CVE-2026-93577; defenders should treat the regex-compiler component as a repeated bug class and patch to the latest releases. Exploit mechanics beyond the advisory text (memory-corruption primitive, payload construction, reliability) are not publicly documented.

GitLab self-managed servers have a recent history of rapid weaponization: BleepingComputer notes CVE-2026-85706, a max-severity path traversal / authentication bypass in the repository commits API (fixed 2026-09-12 in 19.1.8, 19.2.6 and 19.3.2), was added to CISA's KEV catalog, with internet-wide probing and public PoC code reported shortly after disclosure per third-party reporting (SOC Prime, Rapid7, SOCRadar). That is a separate flaw and not evidence of exploitation of CVE-2026-97229, but it justifies urgent patching.

Defensive relevance: a self-managed GitLab server holds source code, CI/CD variables, runner registration tokens, deploy keys and service credentials, so code execution on the application host is a high-value supply-chain pivot. Post-exploitation techniques mapped below are assessed impacts of server-side code execution on a CI/CD platform and are not reported in-the-wild behavior.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1059 Command and Scripting Interpreter
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1552.001 Unsecured Credentials: Credentials In Files
- T1213.003 Data from Information Repositories: Code Repositories
- T1005 Data from Local System

## Sources

- [BleepingComputer: GitLab warns of max severity code execution vulnerability in regex compiler engine](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/)
- [GitLab Patch Release 19.4.2 - CVE-2026-97229 integer overflow issue in CI/CD Regular Expression Compiler](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/#cve-2026-97229---integer-overflow-issue-in-cicd-regular-expression-compiler-impacts-gitlab-ceee)
- [GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7 (CVE-2026-93577 and CVE-2026-89078, related regex compiler/parser flaws)](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/)
- [stack.watch: GitLab CE 19.2-19.4 CI/CD Regex Integer Overflow (CVE-2026-93577)](https://stack.watch/vuln/CVE-2026-93577/)
- [Wiz Vulnerability Database: CVE-2026-93577](https://www.wiz.io/vulnerability-database/cve/cve-2026-93577)
- [NVD: CVE-2026-93577](https://nvd.nist.gov/vuln/detail/CVE-2026-93577)
- [OpenCVE: CVE-2026-93577](https://app.opencve.io/cve/CVE-2026-93577)
- [SOC Prime: CVE-2026-85706 Critical GitLab Path Traversal Flaw Exploited in the Wild (separate, related-context GitLab flaw)](https://socprime.com/blog/cve-2026-85706-critical-gitlab-path-traversal-flaw)
- [Rapid7 ETR: CVE-2026-85706 Critical GitLab Path Traversal Exploited in the Wild](https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild)
- [TechRadar: CISA warns hackers are exploiting max severity GitLab flaw](https://www.techradar.com/pro/security/cisa-warns-hackers-are-exploiting-max-severity-gitlab-flaw-urges-all-businesses-to-patch-immediately)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3356