CISA added GitLab CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog on October 29, 2026, citing evidence of active exploitation. Administrators should check the affected GitLab branch and, for deployments that use a separately installed Ruby runtime, update Ruby as well as GitLab. CISA GitLab
GitLab describes the flaw as an integer overflow in the CI/CD regular-expression compiler and assigns it a CVSS 3.1 score of 10.0. Under certain conditions, a specially crafted regular expression in CI/CD configuration could allow an unauthenticated user to execute arbitrary code on a GitLab server.
Which GitLab versions are affected?
GitLab's advisory lists these affected Community Edition and Enterprise Edition version ranges and fixes:
| GitLab branch | Affected versions | Fixed version |
| 19.2 | Before 19.2.8 | 19.2.8 |
| 19.3 | Before 19.3.5 | 19.3.5 |
| 19.4 | Before 19.4.2 | 19.4.2 |
GitLab said GitLab.com was already running a patched version and GitLab Dedicated tenants had been patched before the advisory was published. For self-managed installations, use the fixed release corresponding to the branch in service. GitLab also published six detections to help self-managed customers identify exploitation attempts. GitLab
When a GitLab update is not enough
A deployment using a separately installed Ruby runtime may need a Ruby update in addition to the GitLab application fix. Alpine Linux said the fix was included in Ruby bundled with GitLab's official packages and images. Alpine's own image used standard Ruby, so upgrading GitLab to 19.3.6 on October 22 did not fix the runtime. For deployments using their own Ruby, Alpine named Ruby 3.3.13, 3.4.12, or 4.0.9 or later as fixed versions. Alpine Linux
Alpine said its October 27 image included Ruby 3.3.13, while older image tags and 19.3.6 images built before that date remained vulnerable. That distinction makes the runtime and image build relevant alongside the GitLab version for custom deployments.
What Alpine reported about the attack
Alpine said attackers targeted its GitLab instance on October 20 and 21, when it was running version 19.3.4. The activity caused eight worker crashes; in four cases, the attacker reached partway through the exploit before it failed at the next step.
Alpine found no evidence that code execution succeeded, but said it could not rule out success. It rebuilt the instance and reported no tampering in the aports repository, packages, or October 21 releases it checked. These findings concern Alpine's GitLab instance. Alpine Linux
Who must follow CISA's BOD 26-04?
CISA says Binding Operational Directive 26-04 applies to Federal Civilian Executive Branch (FCEB) agencies. It encourages other organizations to prioritize vulnerabilities in the KEV catalog, but the directive's requirements apply to FCEB agencies. CISA
