GitLab warns of max severity code execution vulnerability

GitLab has disclosed and patched a maximum-severity remote code execution vulnerability, tracked as CVE-2026-97229, in its CI/CD Regular Expression Compiler. The flaw, caused by an integer overflow, could allow unauthenticated attackers to execute arbitrary code on GitLab servers by supplying a specially crafted regular expression in a pipeline configuration file. The vulnerability affects self-managed GitLab instances prior to versions 19.2.8, 19.3.4, and 19.4.2, and immediate patching is advised. GitLab.com is already protected, and dedicated customers are unaffected.

AI-extracted · verify before operational use