GitLab patches critical integer overflow in CI/CD regex compiler enabling unauthenticated remote code execution

GitLab disclosed CVE-2026-97229, a critical integer overflow in the CI/CD regular expression compiler that parses and evaluates regular expressions in pipeline configuration files. Under certain conditions, an unauthenticated user can execute arbitrary code on the GitLab server through a specially crafted regular expression. It affects versions from 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2, with fixes in 19.2.8, 19.3.4, and 19.4.2. Self-managed installations must upgrade immediately, while GitLab.com already runs the patched version and Dedicated customers need no action. A researcher reported it through GitLab's HackerOne program, and no exploitation is reported.

Check

Upgrade self-managed GitLab to 19.2.8, 19.3.4, or 19.4.2 immediately, since GitLab.com and Dedicated are already covered and no action is needed there.

Affected

Self-managed GitLab versions before the fixed releases let an unauthenticated user run arbitrary code on the server through a crafted regular expression in pipeline configuration.

Fix

Apply the fixed GitLab releases to self-managed installations, restrict who can submit pipeline configurations, and review the server for unexpected code execution.