ZeroDayAlert

CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

GitLab Community Edition and Enterprise Edition Added to KEV 2026-10-29 Federal due 2026-11-01 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

GitLab Community Edition and Enterprise Edition are affected by an integer overflow vulnerability in CI/CD configuration parsing. The flaw permits unauthenticated users to execute arbitrary code on the GitLab server by submitting a maliciously crafted regular expression. Both self-hosted and cloud-hosted deployments are in scope; the record does not specify affected version ranges or whether managed GitLab instances are treated differently from self-hosted installations.

How to check whether this touches you

  • Inventory whether you run GitLab Community Edition or Enterprise Edition in your environment, and in what deployment model (self-hosted, cloud-hosted, or hybrid).
  • Establish whether your GitLab instance accepts CI/CD pipeline configuration from untrusted users or public repositories, and whether the instance is reachable from the internet or from networks you do not fully control.
  • Check the running version against GitLab's security advisories and release notes; note that backported security fixes may be present in patch versions that do not match the main release branch.
  • If you use a managed GitLab service, confirm with your provider whether patches have been applied and obtain their attestation of remediation status.

What to do

  1. Immediate: Restrict network access to your GitLab instance to authenticated users only, and disable CI/CD pipeline execution from untrusted or external sources if operationally feasible.
  2. Urgent: Check GitLab's official security advisories for the specific remediation version and apply patches according to CISA's BOD 26-04 guidance (due by 2026-11-01 for federal stakeholders). If you cannot patch within that window, escalate to your change advisory board and document the risk acceptance.
  3. Concurrent: Enable and review audit logs for CI/CD configuration submissions, particularly any regular expressions in pipeline definitions, and flag unusual or failed regex parsing events for investigation.
  4. If unavoidable delays occur: Implement compensating controls such as disabling CI/CD features, moving workloads to a patched instance, or discontinuing use of GitLab pending remediation.

If you find you were exposed

Exploitation of integer overflow flaws often occurs before disclosure and public tooling is available; retrospective hunting will depend on whether you retain CI/CD pipeline logs and GitLab server logs covering the period from initial deployment through the patch date. Prioritise recovery of logs containing submitted pipeline configurations and any error messages from regex parsing failures. If logs have expired or were not retained, document the gap and escalate to your forensics and incident response teams for assessment of whether complementary telemetry (network, host-level process logs) can establish the scope of exposure.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-97229 is being exploited. It cannot tell you whether Community Edition and Enterprise Edition is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →