Vulnerability report

Exploitation Attempts Observed in the Wild Confirmed Confidence In CISA KEV

CVE-2026-97229

Integer Overflow or Wraparound in GitLab

GitLab · affected before 19.2.8

Watch CVE-2026-97229 Browse KEV feed
Severity
CVSS 10.0 · Critical
Confidence
Confirmed
Exploit status
Observed in sensors
EPSS
26.6%
First observed
21 Oct 2026
Last observed
21 Oct 2026

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-97229 is an unauthenticated Integer Overflow or Wraparound in GitLab. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2...

Have exploitation attempts been observed?

Yes. Previdian sensors have observed 1 exploitation attempt, 1 unique attacker IP, and 1 country targeting CVE-2026-97229. First observed Oct 21, 2026. Listed in CISA KEV. Also reported by third-party sources. Confidence is confirmed.

Who is affected?

GitLab affected before 19.2.8.

What should we do?

Patch immediately, validate internet-facing exposure, and monitor for matching requests.

Overview

Integer Overflow or Wraparound in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

GitLab Affected
GitLab
Before 19.2.8 Before 19.3.5 Before 19.4.2
Published
13 Oct 2026
Attempts Observed Since
21 Oct 2026
Attack vector
Remote
Complexity
Low
Privileges
None
User interaction
None

Tags

cisa

CVE References

Exploitation evidence

Evidence of exploitation attempts

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploitation Attempts Observed in the Wild

Previdian sensor

Recorded 29 Oct 2026

Previdian sensors observed exploitation attempts targeting this vulnerability before a third-party report.

Proof of concept available

CVE

Recorded 13 Oct 2026

Public scanner or PoC coverage increases practical exploitability.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access
Source Added
CISA First 2026-10-29 20:01 UTC
The Hacker News 2026-10-30 07:30 UTC
Security Affairs 2026-10-30 21:21 UTC

Sensor telemetry

Previdian Sensor Observations

Previdian sensor observations are exploitation attempts targeting this vulnerability. They do not show that the target was vulnerable or that the attempt succeeded. The cards and chart show volume, unique attackers, and daily activity.

1

Attempts observed

1

Unique attacker IPs

1

Attacker countries

JP

1

Sensors observed

CVE-2026-97229 exploitation attempts over the last 12 days

Daily events observed by Previdian sensors

Updated 31 Oct 2026

0
1
0
0
0
0
0
0
0
0
0
0
20 Oct 23 Oct 26 Oct 31 Oct

First observed 21 Oct 2026 · Last observed 21 Oct 2026

Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.

Start 14-day Pro trial

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts
1
1
0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

10.0 Critical

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

26.6%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Integer Overflow or Wraparound CWE-190

Recent mention · Security Affairs

U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited...

Read full advisory

All Mentions

Recent mention · Security Affairs

U.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog

Security Affairs · 30 Oct 2026

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added GitLab and Cisco vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: CVE-2026-97229 is a critical security flaw that could let attackers run code on […]

Recent mention · The Hacker News

CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV

The Hacker News · 30 Oct 2026

Ravie LakshmananOct 30, 2026Vulnerability / DevSecOps The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD...

Recent mention · The Hacker News

Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open

The Hacker News · 29 Oct 2026

Swati KhandelwalOct 29, 2026Vulnerability / Cyber Attack An attacker tried to exploit a critical GitLab vulnerability on the Alpine Linux project's own GitLab server a week after GitLab released a fix, Alpine Linux said on 28 October. The flaw, CVE-2026-97229 (CVSS score: 10.0), can let an attacker run code on a GitLab server through a crafted regular expression in a CI configuration. Alpine found no evidence that the attack worked but cannot rule it out, so it rebuilt the server from scratch and reset every account's password. GitLab's fix is a set of patches to the Ruby that GitLab...

Recent mention · The Hacker News

Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws

The Hacker News · 23 Oct 2026

Swati KhandelwalOct 23, 2026Vulnerability / Software Security Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any application that builds a regular expression from text an attacker controls is affected, not just GitLab. Which Applications Are Affected In...

Recent mention · The Hacker News

Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases

The Hacker News · 21 Oct 2026

Swati KhandelwalOct 21, 2026Vulnerability / Software Security GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an instance updated then is in range again. The flaw, tracked as CVE-2026-110264, is rated 10.0 on the CVSS scale, the maximum. GitLab says...

Recent mention · Security Affairs

Security Affairs newsletter Round 600 by Pierluigi Paganini – INTERNATIONAL EDITION

Security Affairs · 18 Oct 2026

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. North Korean IT Workers Used Stolen US Identities to Earn $3 Million U.S. CISA adds Fortinet Multiple […]

Recent mention · Rapid7

Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)

Rapid7 · 16 Oct 2026

OverviewOn October 12, 2026, GitLab released 19.4.2, 19.3.5, and 19.2.8 to fix CVE-2026-97229, an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar. GitLab assigned it a CVSS score of 10.0 and described possible code execution by an unauthenticated user.The advisory states that CVE-2026-97229 affects GitLab CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab says all deployment types are affected unless stated otherwise. GitLab.com was patched before disclosure, and Dedicated customers do not need...

Recent mention · Security Affairs

GitLab Patches Max-Severity Vulnerability CVE-2026-97229

Security Affairs · 13 Oct 2026

GitLab fixed a critical vulnerability with a maximum CVSS score of 10.0 that could let unauthenticated attackers run code on its servers. GitLab has addressed a critical security flaw, tracked as CVE-2026-97229 (CVSS score of 10.0), that could let attackers run code on its servers without logging in. The flaw affects Community Edition (CE) and […]

Recent mention · Rapid7

CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab

Rapid7 · 13 Oct 2026

OverviewOn October 12, 2026, GitLab published a critical patch release for CVE-2026-97229, an integer overflow or wraparound (CWE-190) in the CI/CD regular expression compiler affecting GitLab Community Edition (CE) and Enterprise Edition (EE). GitLab assigned the vulnerability a CVSSv3.1 score of 10.0. Under certain conditions, a remote attacker can execute arbitrary code on an affected GitLab server through a specially crafted regular expression stored in a malicious CI/CD configuration. While the vendor supplied CVSS score indicates that exploitation is fully unauthenticated, in...

Recent mention · SOCRadar

CVE-2026-97229: Critical GitLab RCE

SOCRadar · 13 Oct 2026

CVE-2026-97229: Critical GitLab RCE GitLab has issued an urgent patch for CVE-2026-97229, a maximum severity integer overflow vulnerability residing in its CI/CD Regular Expression Compiler. Left unaddressed, the securit

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Noshadi-sec/CVE-2026-97229

github · Created 2026-10-26 15:14:45 UTC · 0 stars · AI assessment 82%

CVE-2026-97229 an external exploit for GitLab CI lint regex RCE. It is used only against a live GitLab target with permission. It creates a project, pushes a malicious CI configuration, triggers the CI lint endpoint, and receives command output through an HTTP callback. This is for authorized security research only.

OppositDeer/Gitlab-RCE-CVE-2026-97229

github · Created 2026-10-16 11:10:59 UTC · 1 stars · AI assessment 84%

CVE-2026-97229: GitLab RCE Unauthenticated via CI Lint

CVE-2026-97229 Exploit: GitLab CI Regexp RCE

1dayexploit · Created 2026-10-12 20:30:00 UTC

Integer overflow in GitLab CI/CD regex compiler (CVE-2026-97229) leads to remote code execution affecting CE/EE versions 19.2-19.4. CVSS 10.0.

HackerOne Bug Bounty Report #4058589

cve · Created Unknown

HackerOne Bug Bounty Report #4055749

cve · Created Unknown

Timeline

From disclosure to observed exploitation attempts

  1. 21:21 UTC

    KEV confirmed by Security Affairs

    Exploitation attempts reported by an external source

  2. 07:30 UTC

    KEV confirmed by The Hacker News

    Exploitation attempts reported by an external source

  3. 20:01 UTC

    Added to CISA KEV

    Listed in the CISA Known Exploited Vulnerabilities catalog

  4. 02:20 UTC

    Added to the Previdian watchlist

    Pro and Enterprise Watch users had 2 weeks of early warning before CISA KEV. Also 2 weeks before Previdian KEV.

  5. 01:05 UTC

    CVE published

    Vulnerability disclosed publicly

  6. 20:30 UTC

    Public PoC available

    Public proof-of-concept code published

  7. 10:04 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-97229

Sample API response 
{
  "cve_id": "CVE-2026-97229",
  "confidence": "Confirmed",
  "cvss_score": 10.0,
  "cvss_estimated": false,
  "epss_score": 0.26569,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 1, "sensors": 1 }
}