If you run GitLab — self-hosted or managed — this one matters.
CVE-2026-97229 is a CVSS 10.0 integer overflow in GitLab's CI/CD regex compiler.
An unauthenticated attacker sends a crafted regex pattern in a pipeline
definition. The compiler overflows, corrupts the heap, and execution follows.
No login required. No pipeline needs to run.
CISA added it to the Known Exploited Vulnerabilities catalog with a remediation
deadline of November 1, 2026. Active exploitation confirmed against Alpine Linux
infrastructure.
What makes this different from most CVEs:
The attack surface is a .gitlab-ci.yml file — something every developer on
your team touches. On a self-hosted instance, anyone who can submit a merge
request can trigger it. On a public project, that's anyone on the internet.
The fix exists: GitLab 17.8.1.
If you're running anything below that, you're exposed. The patch ships with
GitLab 17.8.1 and later. Self-hosted admins need to update manually —
GitLab.com was patched by the vendor.
If you can't patch immediately:
- Disable public project creation
- Restrict who can submit merge requests on public repos
- Watch for unusual CI job failures or unexpected process spawns from the runner
I wrote a full technical breakdown covering the integer overflow mechanism,
the heap corruption path, exploitation against Alpine, and the KEV timeline:
👉 https://threataft.com/articles/gitlab-cve-2026-97229-regex-rce
Cross-posted from ThreatAft with canonical URL set to the original.
Top comments (0)