CVE-2026-97229

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.2 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1

Description An integer overflow (CWE-190) exists in the CI/CD Regular Expression Compiler, specifically within the Onigmo native regex VM bundled with Ruby. Insufficient validation of specially crafted regular expressions in CI/CD configurations allows an unauthenticated attacker to execute arbitrary code on the GitLab server as the git OS account. The issue is triggered when a crafted quantifier using an inline comment (e.g., {5(?#)7805}) bypasses size checks in the compile quantifier node() function, leading to a memory overflow that can be leveraged to redirect execution to a system() call. Exploitation can be triggered via a GET request to the CI lint API endpoint /api/v4/projects/<id>/ci/lint using the content ref parameter.

Recommendations Upgrade GitLab CE/EE version 19.2 to 19.2.8. Upgrade GitLab CE/EE version 19.3 to 19.3.5. Upgrade GitLab CE/EE version 19.4 to 19.4.2. As a temporary mitigation, restrict unauthenticated access to public attacker-writable projects or block access to the /api/v4/projects/<id>/ci/lint endpoint.