CVE-2026-97229BIT-GITLAB-2026-97229
Integer Overflow or Wraparound in GitLab
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 19.2.8, 19.3.5, 19.4.2
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Affected versions
- GitLab GitLab
From 19.2 · fixed in 19.2.8; From 19.3 · fixed in 19.3.5; From 19.4 · fixed in 19.4.2
- gitlabBitnami
From 19.2.0 · fixed in 19.2.8; From 19.3.0 · fixed in 19.3.5; From 19.4.0 · fixed in 19.4.2