critical 10.0

CVE-2026-97229 kev in the critical feed json

Integer Overflow or Wraparound in GitLab

published 2026-10-13 27d ago modified 2026-11-02 7d ago also BIT-gitlab-2026-97229 , EUVD-2026-98214

cvss: 10.0; version 3.1, CNA
cisa kev: Exploited; added 2026-10-29
epss: 65.2%; EPSS 65.2% chance of exploitation in 30 days, percentile 99.2%
public exploits: 1; Metasploit, plus a Nuclei check

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Patch / fix

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

fixed in 2 distros 6 links 1

bitnami gitlab 19.2.8, 19.3.5, 19.4.2
GitLab GitLab 19.2.8, 19.3.5, 19.4.2

debian opensuse almalinux rocky linux alpine azure linux

ruby3.3 Debian 13 3.3.13-0+deb13u1

debian advisories DEBIAN-CVE-2026-97229

ruby4.0 openSUSE Tumbleweed 4.0.9-1.1

opensuse advisories openSUSE-SU-2026:12252-1

ruby AlmaLinux 9 3.0.7-170.el9_8
rubygems AlmaLinux 9 3.2.33-170.el9_8
ruby-libs AlmaLinux 9 3.0.7-170.el9_8
rubygem-irb AlmaLinux 9 1.3.5-170.el9_8
rubygem-rbs AlmaLinux 9 1.4.0-170.el9_8
rubygem-rss AlmaLinux 9 0.2.9-170.el9_8
rubygem-json AlmaLinux 9 2.5.1-170.el9_8
rubygem-rake AlmaLinux 9 13.0.3-170.el9_8

almalinux advisories ALSA-2026:96067 ALSA-2026:96068 ALSA-2026:96120 ALSA-2026:96233

rubygem-pg Rocky Linux 9 1.5.4-2.module+el9.7.0+40188+314ad260.0.1
rubygem-mysql2 Rocky Linux 9 0.5.5-3.module+el9.7.0+40032+36e56d0d
rubygem-pg Rocky Linux 9 1.6.3-1.module+el9.8.0+40094+ce01217c
rubygem-mysql2 Rocky Linux 9 0.5.7-1.module+el9.8.0+40094+ce01217c

rocky linux advisories RLSA-2026:96068 RLSA-2026:96120

ruby Alpine 3.21 3.3.13-r0
ruby Alpine 3.24, Alpine 3.23, Alpine 3.22 3.4.12-r0

alpine advisories ALPINE-CVE-2026-97229

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

ruby Azure Linux 3.0 3.3.13-0

azure linux advisories AZL-111074

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/rapid7/metasploit-framework#22017 pull request

Is CVE-2026-97229 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-97229 updated 2026-11-09 cvss 9.8

ruby: integer overflow issue in CI/CD regular expression compiler

Red Hat Enterprise Linux 6 ruby, ruby-ri, ruby-irb, ruby-libs, ruby-rdoc, ruby-tcltk Red Hat Enterprise Linux 7 ruby, ruby-irb, rubygems, ruby-libs, ruby-tcltk, rubygem-json, +6 more Red Hat Enterprise Linux 8 ruby, ruby-irb, rubygems, ruby-libs, rubygem-pg, rubygem-irb, +25 more
affected: workaround, no fix available
Red Hat Enterprise Linux AppStream (v. 9) ruby 3.0.7-170.el9_8, ruby-libs 3.0.7-170.el9_8, rubygems 3.2.33-170.el9_8, rubygem-irb 1.3.5-170.el9_8, rubygem-rbs 1.4.0-170.el9_8, rubygem-rss 0.2.9-170.el9_8, +59 more
fixed: vendor fix RHSA-2026:96067
Red Hat Enterprise Linux AppStream (v. 10) ruby 3.3.13-16.el10_2, ruby4.0 4.0.9-38.el10_2, rubygems 3.5.22-16.el10_2, ruby-libs 3.3.13-16.el10_2, rubygem-rbs 3.4.0-16.el10_2, rubygem-rss 0.3.1-16.el10_2, +18 more
fixed: vendor fix RHSA-2026:96235
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) ruby-doc 3.0.7-170.el9_8
fixed: vendor fix RHSA-2026:96067
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby-doc 3.3.13-16.el10_2, ruby4.0-doc 4.0.9-38.el10_2
fixed: vendor fix RHSA-2026:96235
Red Hat Hardened Images ruby4.0 4.0.9-41.hum1, ruby3.3 3.3.13-23.8.hum1, ruby3.4 3.4.12-33.1.hum1, ruby4.0-libs 4.0.9-41.hum1, ruby3.3-libs 3.3.13-23.8.hum1, ruby3.4-libs 3.4.12-33.1.hum1, +6 more
fixed: vendor fix RHSA-2026:88880
Red Hat Satellite 6.16 for RHEL 8 python-pyyaml 6.0.1-1.el8pc, openvox-agent 8.32.0-1.el8sat, python3.11-pyyaml 6.0.1-1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-pyyaml 6.0.1-1.el9pc, openvox-agent 8.32.0-1.el9sat, python3.11-pyyaml 6.0.1-1.el9pc
fixed: vendor fix RHSA-2026:95655
Red Hat Satellite 6.17 for RHEL 9 openvox-agent 8.32.0-1.el9sat
fixed: vendor fix RHSA-2026:95656

show 5 more

Red Hat Satellite 6.18 for RHEL 9 openvox-agent 8.32.0-1.el9sat
fixed: vendor fix RHSA-2026:95657
Red Hat Satellite 6.19 for RHEL 9 openvox-agent 8.32.0-1.el9sat
fixed: vendor fix RHSA-2026:95652
Red Hat Hardened Images hi/ruby, rubygem4.0-rss 0.3.2-41.hum1, rubygem4.0-irb 1.16.0-41.hum1, rubygem4.0-racc 1.8.1-41.hum1, rubygem4.0-rbs 3.10.0-41.hum1, rubygem4.0-rdoc 7.0.4-41.hum1, +46 more
not affected: vulnerable code not present
Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
not affected: component not present
Red Hat Satellite 6.16 for RHEL 8 python-nh3 0.3.0-2.el8pc, python-brotli 1.2.1-1.el8pc, python-django 4.2.30-2.el8pc, python-pillow 13.0.0-1.el8pc, python-urllib3 2.8.0-1.el8pc, python3.11-nh3 0.3.0-2.el8pc, +11 more Red Hat Satellite 6.16 for RHEL 9 python-nh3 0.3.0-2.el9pc, python-brotli 1.2.1-1.el9pc, python-django 4.2.30-2.el9pc, python-pillow 13.0.0-1.el9pc, python-urllib3 2.8.0-1.el9pc, python3.11-nh3 0.3.0-2.el9pc, +11 more Red Hat Satellite 6.17 for RHEL 9 python-brotli 1.2.1-1.el9pc, python-django 4.2.30-2.el9pc, python-pillow 13.0.0-1.el9pc, python-urllib3 2.8.0-1.el9pc, openvox-server 8.18.0-1.el9sat, python-gitpython 3.2.1-1.el9pc, +7 more Red Hat Satellite 6.18 for RHEL 9 openvox-server 8.18.0-1.el9sat, python3.12-brotli 1.2.1-1.el9pc, python3.12-django 4.2.30-3.el9pc, python3.12-pillow 13.0.0-1.el9pc, python3.12-urllib3 2.8.0-1.el9pc, python3.12-gitpython 3.2.1-1.el9pc, +2 more Red Hat Satellite 6.19 for RHEL 9 openvox-server 8.18.0-1.el9sat
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2026-10-12 First public exploit (Metasploit exploit/multi/http/gitlab_cicd_regexp_rce_cve_2026_97229)
2026-10-13 CISA SSVC: exploitation active
2026-10-13 Published
2026-10-29 Added to CISA KEV
2026-11-01 CISA patch deadline

Known exploited

Added: 11d ago (2026-10-29)
Patch by: 2026-11-01 (8d ago)
Ransomware: Not known
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Vendor, product: GitLab, Community Edition and Enterprise Edition
CISA name: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 27d ago (2026-10-13)

Exploit prediction

65.22% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/multi/http/gitlab_cicd_regexp_rce_cve_2026_97229 GitLab CI/CD RegExp Integer Overflow Remote Code Execution metasploit exploit, good rank, 2026-10-12
Nuclei template GitLab CE/EE < 19.2.8 / 19.3.5 / 19.4.2 - Unauthenticated RCE via Onigmo Integer Overflow nuclei detection template
hackerone.com https://hackerone.com/reports/4055749 referenced PoC, tagged "exploit" by a source, unverified
hackerone.com https://hackerone.com/reports/4058589 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
OSV	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
bitnami	gitlab	>=19.2.0, <19.2.8 >=19.3.0, <19.3.5 >=19.4.0, <19.4.2	19.2.8 19.3.5 19.4.2

Affected products

GitLab GitLab

Classification

Weakness

CWE-190 Integer Overflow or Wraparound

Technology feeds

GitLab rss critical rss

References

github.com /rapid7/metasploit-framework/pull/22017
issue-tracking, third-party-advisory
hackerone.com /reports/4055749
technical-description, exploit, permissions-required, web
hackerone.com /reports/4058589
technical-description, exploit, permissions-required, web
docs.gitlab.com /releases/patches/patch-release-gitlab-19-4-2-released/
release-notes, vendor-advisory, advisory
gitlab.com /gitlab-org/gitlab/-/work_items/630686
broken-link, report
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-97229
government-resource, us-government-resource, web
ruby-lang.org /en/news/2026/10/23/regexp-fixes-for-gitlab-cves/
third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2026-97229
web

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.