CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

According to Help Net Security, CVE-2026-97229 is an integer overflow vulnerability in GitLab's CI/CD Regular Expression Compiler, and it affects both GitLab Community Edition (CE) and Enterprise Edition (EE)[2]. The outlet says GitLab has assigned the vulnerability a CVSS score of 10.0, the highest possible.[2]Rapid7 says it has independently reproduced arbitrary code execution on an unpatched, official GitLab CE image[3]. Its testing found that an attacker must first be able to commit a malicious CI/CD configuration file[3] to a public project.SecurityOnline reports that Censys estimates that 25,766 internet-facing hosts and 79,224 web properties currently run vulnerable versions.[4]Alpine Linux says that on October 20 and 21, a newly registered account sent crafted CI configurations[5] to its unpatched GitLab instance, which crashed GitLab worker processes 8 times.[5] The project says it rebuilt the GitLab instance from scratch[5] because it could not rule out code execution. It also says no signing keys were exposed.[5]Alpine also warns that upgrading GitLab alone may not fix the flaw: "The fix isn't in GitLab's own code but in a patch to Ruby, which GitLab applies only in its official packages."[5]According to HOL, GitLab's Linux packages and official images are fixed from 19.4.2, 19.3.5 and 19.2.8[1]. Custom builds also need Ruby 3.3.13, 3.4.12 or 4.0.9.[1] HOL says CISA has set a 1 Nov 2026 due date for US federal agencies and forensic triage required.[1]