GitLab Urges Immediate Patching for Critical Regex Compiler Flaw

Key points

• The vulnerability stems from an integer overflow in the CI/CD regular expression compiler, which fails to validate user input adequately.
• GitLab credits researcher 'joaxcar' for discovering the flaw through its HackerOne bug bounty program.
• The October 8 release fixes 24 vulnerabilities in total, including one critical, five high-severity, and 14 medium-severity issues.
• GitLab.com and GitLab Dedicated customers are already protected and do not require action.
• No evidence of in-the-wild exploitation has been reported as of October 12, 2026.

Background

This is the latest in a series of critical GitLab vulnerabilities disclosed in 2026. In September, GitLab patched CVE-2026-85706, a critical path-traversal flaw that was actively probed in the wild. In October, it addressed CVE-2026-90970, a critical AI Gateway flaw allowing command execution. CISA has flagged five GitLab flaws as exploited since 2021.

How outlets are covering it

BleepingComputer and Cybersecurity Dive emphasize the urgency of patching self-managed instances, noting that GitLab serves over 30 million users and more than 50% of Fortune 100 companies. Cyber Kendra provides technical detail, explaining that the integer overflow occurs in Ruby's Onigmo regex engine, where oversized repeat patterns cause compiled program sizes to exceed 32-bit integer limits. Cybersecurity News focuses on the arbitrary code execution risk but offers less technical depth. All sources agree that cloud-hosted GitLab.com instances are already patched.

Why it matters

GitLab is a critical DevSecOps platform used by major enterprises including Nvidia, Lockheed Martin, and Goldman Sachs. A successful exploit could allow attackers to compromise build pipelines, steal secrets, or sabotage software releases. The flaw’s low attack complexity and lack of required privileges make it highly exploitable.

What to watch

Self-managed GitLab users must upgrade to patched versions immediately. GitLab will publish issue tracker entries for these vulnerabilities 90 days after the patch release. CISA has not yet added CVE-2026-97229 to its exploited vulnerabilities catalog, but monitoring for exploitation attempts is advised.