Published Corrective updates to the platform for organizing collaborative development GitLab – 19.4.2, 19.3.4, 19.2.8, which fixed 24 vulnerabilities. The most dangerous vulnerability (CVE-2026-97229) allows you to remotely execute your code on the server. The problem is caused by an integer overflow in the regular expression compilation code. The attack can be carried out by an unauthenticated user through the use of a specially formatted regular expression in the CI/CD configuration. The vulnerability has been assigned a severity level of 10 out of 10.
All users are advised to immediately install the update. The details of the problem have not yet been disclosed and will become publicly available 30 days after the fix is published (a similar vulnerability was recently fixed in the libpcre2 library, but it was not caused by an integer overflow). The vulnerability has been submitted to GitLab as part of HackerOne’s vulnerability bounty program.