{"basis":"claimed","id":"CVE-2026-97229","name":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","vendorProject":"GitLab","product":"Community Edition and Enterprise Edition","publishedAt":"2026-10-13","cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2026-10-29","dueDate":"2026-11-01","ransomware":false},"epss":{"score":0.273,"percentile":0.9806,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"none","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"Integer Overflow or Wraparound in GitLab","description":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","cwes":["CWE-190"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T22:17:38.477Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[],"social":{"total":13,"first_seen":"2026-10-28T23:45:46.000Z","daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":1},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":12}],"top_posts":[{"source":"hn","kind":"post","url":"https://news.ycombinator.com/item?id=50282544","author":"sashk","author_name":null,"avatar_url":null,"text":"GitLab Security Incident: Attempted Exploitation of CVE-2026-97229","engagement":256,"posted_at":"2026-10-28T23:45:46.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/unnchain.bsky.social/post/3mzegvc522526","author":"unnchain.bsky.social","author_name":"mt4110","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:yb5zq3zoqg5f46zp6knudhjw/bafkreih6dwpgyso4wxqabj7woeimxcvdn2zis2uv3vvvi7mhrv37jll2vm","text":"補足（11/3）：このCVE-2026-97229は悪用が確認されています。原因はGitLabに同梱されたRubyの正規表現エンジンなので、ソースや自作イメージで標準のRubyを使っている環境では、GitLabの更新に加えてRuby 3.3.13/3.4.12/4.0.9以降への更新も必要です。\nhttps://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/","engagement":0,"posted_at":"2026-11-02T23:07:40.000Z"},{"source":"x","kind":"post","url":"https://x.com/rMATLAB_x/status/2117392379972100494","author":"rMATLAB_x","author_name":"merci :D","avatar_url":"https://pbs.twimg.com/profile_images/1998177254199996416/kQoXMi7B_bigger.jpg","text":"GitLabのCVE-2026-97229（CVSS 10.0）が悪用確認され米CISAのKEV入り。CI設定に細工した正規表現で、ログインなしにサーバーでコード実行のおそれ。セルフホストは19.4.2/19.3.5/19.2.8以降へ。自前Rubyの環境はRuby更新も。\n\n#脆弱性 #GitLab https://t.co/fuNPDiaf0B","engagement":0,"posted_at":"2026-11-02T23:04:17.000Z"},{"source":"x","kind":"post","url":"https://x.com/SOCMinute/status/2117385775381987792","author":"SOCMinute","author_name":"SOCMinute","avatar_url":"https://pbs.twimg.com/profile_images/2088035235032125440/p1daMNei_bigger.jpg","text":"1/5 More than 1,000 internet-exposed GitLab servers remain vulnerable to CVE-2026-97229, a CVSS 10.0 unauthenticated RCE now in CISA’s KEV catalog.\n\nThe flaw sits inside CI/CD regular-expression processing. Here is what defenders need to know. 🧵 https://t.co/DvN1Z2u2N2","engagement":0,"posted_at":"2026-11-02T22:38:02.000Z"},{"source":"x","kind":"post","url":"https://x.com/hack4lifemx/status/2117382231656440165","author":"hack4lifemx","author_name":"El M10 🏴‍☠️","avatar_url":"https://pbs.twimg.com/profile_images/2004994522988662784/jX0wRz-b_bigger.jpg","text":"Más de 1.000 servidores #GitLab expuestos a ataques RCE: CISA confirma la explotación activa de CVE-2026-97229 \nhttps://t.co/GjFeEKa7UE","engagement":0,"posted_at":"2026-11-02T22:23:57.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/securityrss.bsky.social/post/3mzedgxfo2q2j","author":"securityrss.bsky.social","author_name":"securityrss.ai","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:geidqukzen75knciqkq77vgq/bafkreidoyaxywcowthlwss4glr4nvr3wvht7eui74we6xh3rgkhq66yvfq","text":"An attacker attempted to exploit a critical GitLab vulnerability (CVE-2026-97229, CVSS 10.0) on Alpine Linux's GitLab server shortly after a fix was released. Although no successful exploit was confirmed, Alpine rebuilt the server and reset passwords as a precaution.","engagement":0,"posted_at":"2026-11-02T22:05:59.333Z"},{"source":"x","kind":"post","url":"https://x.com/tritree0079/status/2117377413621682565","author":"tritree0079","author_name":"amori","avatar_url":"https://pbs.twimg.com/profile_images/1621673326040199170/1Qf-dP6q_bigger.jpg","text":"【GitLab、1,000台超が重大な欠陥に未対応】\n\nShadowserverは11月1日、CVE-2026-97229に脆弱な公開GitLabを1,000台超確認したと公表した。\nこれは未修正の観測数であり、全台の侵害が確認されたという意味ではない。","engagement":0,"posted_at":"2026-11-02T22:04:49.000Z"},{"source":"x","kind":"post","url":"https://x.com/TweetThreatNews/status/2117367202261127266","author":"TweetThreatNews","author_name":"Cybersecurity News Everyday","avatar_url":"https://pbs.twimg.com/profile_images/2113863388669575168/-spPI7aU_bigger.jpg","text":"More than 1,000 internet-exposed GitLab servers remain unpatched against CVE-2026-97229, an actively exploited flaw that can enable unauthenticated remote code execution. GitLab released patches, and CISA added the flaw to its KEV Catalog.\nhttps://t.co/rG6sRoQeNp","engagement":0,"posted_at":"2026-11-02T21:24:14.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/hendryadrian.bsky.social/post/3mzeb4afngi2d","author":"hendryadrian.bsky.social","author_name":"Cybersecurity News Everyday","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:u6celkmubfsmbus5m3aqcrla/bafkreia4qa35zkjv4xhncsa5phk67qxkkinellckmbdgyczdad7yeqdy7m","text":"More than 1,000 internet-exposed GitLab servers remain unpatched against CVE-2026-97229, an actively exploited flaw that can enable unauthenticated remote code execution. GitLab released patches, and CISA added the flaw to its KEV Catalog.","engagement":0,"posted_at":"2026-11-02T21:24:11.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/jbhall56.bsky.social/post/3mze6llbli22q","author":"jbhall56.bsky.social","author_name":"PCI Guru","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:wd23ycs3nif2oshhl3i6vwkd/bafkreif2et3xa3kn4gmxcq2mqmzgv57bc3n5buweopjqqon2va3w7kgssu","text":"Tracked as CVE-2026-97229, this vulnerability stems from an integer overflow weakness and was discovered in the CI/CD Regular Expression Compiler, which parses and evaluates regular expressions in pipeline configuration files. www.bleepingcomputer.com/news/securit...","engagement":0,"posted_at":"2026-11-02T20:39:05.753Z"},{"source":"x","kind":"post","url":"https://x.com/jbhall56/status/2117355573645898064","author":"jbhall56","author_name":"Jeff Hall - PCI Guru - #StandWithUkraine","avatar_url":"https://pbs.twimg.com/profile_images/1540691168102535168/aId_ATMN_bigger.jpg","text":"Tracked as CVE-2026-97229, this vulnerability stems from an integer overflow weakness and was discovered in the CI/CD Regular Expression Compiler, which parses and evaluates regular expressions in pipeline configuration files. https://t.co/TBZgbzBGKD","engagement":0,"posted_at":"2026-11-02T20:38:01.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/alt.pds.lefht.cc/post/3mzdzwfghkk25","author":"alt.pds.lefht.cc","author_name":"alt","avatar_url":null,"text":"2. CVE-2026-97229 · 10 people 🔥\n🟥 Critical 10.0 · GitLab\n\nInteger Overflow or Wraparound in GitLab","engagement":0,"posted_at":"2026-11-02T19:15:40.003Z"}],"exploit_repositories":[]}}