Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
Overview On October 12, 2026, GitLab released 19.4.2 , 19.3.5 , and 19.2.8 to fix CVE-2026-97229 , an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar . GitLab assigned it a CVSS score of 10.0 and described possible code execution by an unauthenticated user. The advisory states that CVE-2026-97229 affects GitLab CE and EE from 19.2 before 19.2.8 , 19.3 before 19.3.5 , and 19.4 before 19.4.2 . GitLab says all deployment types are affected unless stated otherwise. GitLab.com was patched before disclosure, and Dedicated customers do not need to act. Rapid7 researchers developed an end-to-end PoC that reliably runs arbitrary commands
- Vendor
- GitLab, Rapid7
- Product
- GitLab, InsightVM / Nexpose / Metasploit
- CVSS
- 10.0
- EPSS
- 0.27 (p98)
- Exposure class
- Developer platform, Network management
Why it ranks 45 (High)
- CVSS 10.0 critical
- EPSS 0.18 (elevated)
- Product class: developer platform, network management
- Covered by 4 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Rapid7 research (rapid7.com)
- CVE-2026-97229 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.