# CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

- Exploited (CISA KEV): yes, added 2026-10-29
- Published: 2026-10-13
- CVSS: 10 CRITICAL (v3.1)
- EPSS: 27.3% (98th percentile)
- CWE: CWE-190

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

13 posts seen since 2026-10-28.

- hn 2026-10-28: GitLab Security Incident: Attempted Exploitation of CVE-2026-97229 (https://news.ycombinator.com/item?id=50282544)
- bluesky 2026-11-02: 補足（11/3）：このCVE-2026-97229は悪用が確認されています。原因はGitLabに同梱されたRubyの正規表現エンジンなので、ソースや自作イメージで標準のRubyを使っている環境では、GitLabの更新に加えてRuby 3.3.13/3.4.12/4.0.9以降への更新も必要です。 https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/ (https://bsky.app/profile/unnchain.bsky.social/post/3mzegvc522526)
- x 2026-11-02: GitLabのCVE-2026-97229（CVSS 10.0）が悪用確認され米CISAのKEV入り。CI設定に細工した正規表現で、ログインなしにサーバーでコード実行のおそれ。セルフホストは19.4.2/19.3.5/19.2.8以降へ。自前Rubyの環境はRuby更新も。  #脆弱性 #GitLab https://t.co/fuNPDiaf0B (https://x.com/rMATLAB_x/status/2117392379972100494)
- x 2026-11-02: 1/5 More than 1,000 internet-exposed GitLab servers remain vulnerable to CVE-2026-97229, a CVSS 10.0 unauthenticated RCE now in CISA’s KEV catalog.  The flaw sits inside CI/CD regular-expression processing. Here is what defenders need to know. 🧵 https://t.co/DvN1Z2u2N2 (https://x.com/SOCMinute/status/2117385775381987792)
- x 2026-11-02: Más de 1.000 servidores #GitLab expuestos a ataques RCE: CISA confirma la explotación activa de CVE-2026-97229  https://t.co/GjFeEKa7UE (https://x.com/hack4lifemx/status/2117382231656440165)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-97229 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-97229