GitLab urges administrators of self-managed GitLab instances to patch a critical security flaw, CVE-2026-97229, in its CI/CD Regular Expression Compiler. GitLab says the issue can allow attackers—potentially without authentication, depending on the conditions—to execute arbitrary code on targeted GitLab servers. Multiple outlets report GitLab assigns the vulnerability a CVSS score of 10.0, indicating maximum severity.
The vulnerability is described as an integer overflow that can be triggered through specially crafted input regular expressions related to CI/CD functionality. The impact applies to both GitLab Community Edition (CE) and Enterprise Edition (EE). While reports broadly align on the type of weakness and the affected component, they differ in emphasis: some focus on urgency for immediate patching, while others highlight the possibility of unauthenticated exploitation under specific circumstances.
