GitLab's Monday patch release fixes CVE-2026-97229, a maximum-severity (CVSS 10.0) flaw in the CI/CD Regular Expression Compiler. Under certain conditions, an unauthenticated user can execute arbitrary code on the GitLab server with a specially crafted regular expression in a CI/CD configuration, because regex validation was insufficient (GitLab; BleepingComputer).
The root cause is an integer overflow in the compiler that parses, compiles, and evaluates regexes in pipeline configuration files. Affected self-managed CE and EE lines: 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. Fixed builds are 19.2.8, 19.3.4, and 19.4.2. GitLab.com is already on a patched build. GitLab Dedicated customers do not need to take action (GitLab).
Context for anyone who still has the last GitLab fire open: last month GitLab patched another maximum-severity issue, CVE-2026-85706, and CISA put it on KEV the next day with a three-day federal clock. GitLab says more than 50% of Fortune 100 companies use the platform (BleepingComputer). Known exploitation of CVE-2026-97229 at publish: Undisclosed.
What we'd do before lunch: inventory every self-managed GitLab instance (prod, staging, and the forgotten M&A leftover), upgrade to a fixed build, then hunt for unusual pipeline config pushes from unauthenticated or newly created identities, unexpected runner registrations, and outbound callbacks from the GitLab host since the advisory window opened. If you can't patch today, pull public signup and unauthenticated project visibility off the internet until you can.