CVE-2026-97229 - Integer Overflow issue in CI/CD Regular Expression Compiler impacts GitLab CE/EE
GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Impacted Versions: GitLab CE/EE: all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2
CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.
GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8
https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/
В этот раз Critcal один (хоть и на 10-ку), но в целом список приличный.