GitLab published a critical patch release on 12 October 2026 (versions 19.4.2, 19.3.4 and 19.2.8 for Community Edition and Enterprise Edition) remediating CVE-2026-97229, an integer overflow in the CI/CD Regular Expression Compiler that, under certain conditions, could let an unauthenticated attacker execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. GitLab rates it CVSS 3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Impacted self-managed installs are all CE/EE versions from 19.2 before 19.2.8, from 19.3 before 19.3.5, and from 19.4 before 19.4.2. GitLab.com is already patched; GitLab Dedicated customers do not need to act.

The advisory does not state that the flaw has been exploited in the wild. Researcher joaxcar reported it via HackerOne. GitLab's advisory now titles the release 19.4.2, 19.3.5 and 19.2.8 and lists the affected 19.3 range as before 19.3.5; it says 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled, fixed in 19.3.5.

The same release also ships other High/Medium fixes (XSS in syntax highlighting, several authorization issues, Duo Agent Platform input neutralization, and more) — this card is the Critical regex RCE only.

Primary: GitLab Critical Patch Release 19.4.2/19.3.4/19.2.8 (12 Oct); wire: BleepingComputer and Cybersecurity News (12 Oct).

UPDATE (22 Oct): GitLab fixed a separate, further regular-expression-compiler flaw, CVE-2026-110264 (CVSS 10.0, all versions from 7.0 affected), on 21 October in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13; see the CVE-2026-110264 card.