GitLab warns of max severity code execution vulnerability

GitLab has issued an urgent patch for a maximum-severity flaw, CVE-2026-97229, found in its CI/CD Regular Expression Compiler, which handles parsing and evaluation of regex patterns inside pipeline configuration files. The bug is rooted in an integer overflow that could let an unauthenticated attacker run arbitrary code on a GitLab server simply by submitting a maliciously crafted regular expression in a CI/CD config, due to inadequate validation of these expressions. The issue affects self-managed GitLab Community Edition and Enterprise Edition releases from 19.2 up to 19.2.8, 19.3 up to 19.3.4, and 19.4 up to 19.4.2, and the company is urging all self-hosted customers to upgrade immediately, noting that GitLab.com and GitLab Dedicated are unaffected or already protected. The flaw was reported through GitLab's HackerOne bounty program by researcher 'joaxcar' and follows several other severe GitLab vulnerabilities fixed in recent months, including a 2FA bypass and a path-traversal bug that CISA confirmed was actively exploited.