GitLab warns of max severity RCE flaw CVE-2026-97229

GitLab disclosed a maximum-severity vulnerability, CVE-2026-97229, in its CI/CD Regular Expression Compiler that lets unauthenticated attackers execute arbitrary code on targeted servers. Fixes shipped in CE/EE 19.2.8, 19.3.4 and 19.4.2, and GitLab.com is already patched.

• CVE-2026-97229 is an integer overflow in GitLab's CI/CD regex compiler
• Unauthenticated attackers could run arbitrary code on GitLab servers
• Patched in CE/EE 19.2.8, 19.3.4 and 19.4.2
• GitLab.com already runs the patched version; Dedicated unaffected