CVE-2026-97229: CI/CD regular expression compiler (Ruby Onigmo regex engine)
A regex that passes GitLab's validation in compact US-ASCII form is recompiled by Ruby's Onigmo engine when matched against a UTF-8 repository path. An integer overflow in the program-size calculation then yields invalid VM instructions that can run OS commands as the git user. CISA added it to KEV on 2026-10-29. GitLab's fix is a patch to its bundled Ruby, so Alpine Linux's custom image stayed vulnerable after upgrading to 19.3.6, and Alpine rebuilt its instance after an attempted attack.
Executive Summary & Technical Impact
A regex that passes GitLab's validation in compact US-ASCII form is recompiled by Ruby's Onigmo engine when matched against a UTF-8 repository path. An integer overflow in the program-size calculation then yields invalid VM instructions that can run OS commands as the git user. CISA added it to KEV on 2026-10-29. GitLab's fix is a patch to its bundled Ruby, so Alpine Linux's custom image stayed vulnerable after upgrading to 19.3.6, and Alpine rebuilt its instance after an attempted attack.
Tracked under CVE-2026-97229 (CWE-190 (Integer Overflow or Wraparound)), this vulnerability affects GitLab 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2; custom/source builds on Ruby older than 3.3.13, 3.4.12 or 4.0.9 and carries a severity score of 10.0 (CVSS 3.1, GitLab) (CRITICAL). Engineering and security operations teams running GitLab CE/EE (self-managed) should prioritize upgrading to GitLab 19.2.8, 19.3.5, 19.4.2 (official packages); Ruby 3.3.13, 3.4.12, 4.0.9 for custom builds.
Remediation & Patch Guidance
- Upgrade self-managed GitLab to 19.2.8, 19.3.5, 19.4.2 or later immediately.
- For source installs or custom images, also run Ruby 3.3.13, 3.4.12, 4.0.9 or later.
- Until patched, restrict anonymous access and stop untrusted users from creating or writing to public projects.
- Review GitLab worker crashes since mid-October. If found on an unpatched instance, rotate CI/CD variables, runner tokens and integration credentials.
Frequently Asked Questions (CVE-2026-97229)
What versions are affected by CVE-2026-97229?
CVE-2026-97229 affects GitLab 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2; custom/source builds on Ruby older than 3.3.13, 3.4.12 or 4.0.9 in GitLab CE/EE (self-managed) (CI/CD regular expression compiler (Ruby Onigmo regex engine)).
How do I patch or remediate CVE-2026-97229?
Upgrade affected deployments to GitLab 19.2.8, 19.3.5, 19.4.2 (official packages); Ruby 3.3.13, 3.4.12, 4.0.9 for custom builds and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-97229?
CVE-2026-97229 is rated CRITICAL with a CVSS score of 10.0 (CVSS 3.1, GitLab) (vector: Network; a crafted regex in .gitlab-ci.yml plus a UTF-8 repository path in a public project (an ordinary self-registered account suffices where sign-up and project creation are open)).
GitLab CVE-2026-97229 Is Being Exploited, and Alpine Linux Shows Why Upgrading GitLab Alone May Not Fix It
CISA added the CVSS 10.0 CI/CD regex RCE to KEV on October 29. Alpine's incident report shows the real fix is a Ruby patch, which custom GitLab builds and container images can silently miss.
Read full engineering post-mortem (6 min read) →