GitLab issues urgent patches for critical RCE vulnerability

GitLab has issued emergency security updates to address a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-97229. The flaw carries a maximum CVSS score of 10.0 and affects both GitLab Community Edition (CE) and Enterprise Edition (EE).

The vulnerability stems from an integer overflow within GitLab’s CI/CD regular expression compiler. Insufficient validation of specially crafted regular expressions could allow an unauthenticated attacker to execute arbitrary code on affected servers without requiring user interaction or prior login credentials. Successful exploitation poses a high risk to the confidentiality, integrity, and availability of the GitLab environment.

Administrators of self-managed installations are urged to upgrade immediately to patched versions 19.2.8, 19.3.4, or 19.4.2, depending on their current release branch. While GitLab.com has already implemented the fixes, GitLab Dedicated customers do not require additional action. The issue was reported by security researcher joaxcar through the HackerOne bug bounty program.