Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 19.2 – < 19.2.8, 19.3 – < 19.3.5, 19.4 – < 19.4.2 | 19.2.8 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby3.3 | No fix yet | — |
| Debian 13 | ruby3.3 | 3.3.13-0+deb13u1 | — |
| Debian 12 | ruby3.1 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | gitlab | No fix yet | — |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | ruby +5 | 3.3.13-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | ruby4.0 +2 | 4.0.9-38.el10_2 | ALSA-2026:96233 |
| AlmaLinux 10 | ruby4.0-rubygem-mysql2 | 0.5.7-38.el10_2 | ALSA-2026:96233 |
| AlmaLinux 10 | ruby4.0-rubygem-pg | 1.6.3-38.el10_2 | ALSA-2026:96233 |
| AlmaLinux 10 | rubygem-bigdecimal | 3.1.5-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-bundler | 2.5.22-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-io-console | 0.7.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-irb | 1.13.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-json | 2.7.2-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-minitest | 5.20.0-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-power_assert | 2.0.3-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-psych | 5.1.2-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-racc | 1.7.3-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rake | 13.1.0-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rbs | 3.4.0-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rdoc | 6.6.3.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rexml | 3.4.4-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-rss | 0.3.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-test-unit | 3.6.1-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygem-typeprof | 0.21.9-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 10 | rubygems +1 | 3.5.22-16.el10_2 | ALSA-2026:96235 |
| AlmaLinux 9 | ruby +4 | 3.0.7-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-bigdecimal | 3.0.0-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-bundler | 2.2.33-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-io-console | 0.5.7-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-irb | 1.3.5-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-json | 2.5.1-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-minitest | 5.14.2-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-mysql2 +1 | 0.5.5-3.module_el9.7.0+184+e2e36072 | ALSA-2026:96120, ALSA-2026:96068 |
| AlmaLinux 9 | rubygem-pg +1 | 1.5.4-2.module_el9.7.0+245+447713a2 | ALSA-2026:96120, ALSA-2026:96068 |
| AlmaLinux 9 | rubygem-power_assert | 1.2.1-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-psych | 3.3.2-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rake | 13.0.3-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rbs | 1.4.0-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rdoc | 6.3.4.1-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rexml | 3.2.5-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-rss | 0.2.9-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-test-unit | 3.3.7-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygem-typeprof | 0.15.2-170.el9_8 | ALSA-2026:96067 |
| AlmaLinux 9 | rubygems +1 | 3.2.33-170.el9_8 | ALSA-2026:96067 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | ruby | 3.3.13-16.el10_2 | RLSA-2026:96235 |
| Rocky Linux 10 | ruby4.0 | 4.0.9-38.el10_2 | RLSA-2026:96233 |
| Rocky Linux 9 | ruby | 3.0.7-170.el9_8 | RLSA-2026:96067 |
| Rocky Linux 9 | rubygem-mysql2 | 0.5.5-3.module+el9.7.0+40032+36e56d0d | RLSA-2026:96120, RLSA-2026:96068 |
| Rocky Linux 9 | rubygem-pg | 1.5.4-2.module+el9.7.0+40188+314ad260.0.1 | RLSA-2026:96120, RLSA-2026:96068 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ruby4.0 | 4.0.9-1.1 | openSUSE-SU-2026:12252-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | ruby | 3.4.12-r0 | — |
| Alpine v3.23 | ruby | 3.4.12-r0 | — |
| Alpine v3.22 | ruby | 3.4.12-r0 | — |
| Alpine v3.21 | ruby | 3.3.13-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ruby3.4 +5 | 3.4.12-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-bigdecimal | 3.1.8-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-bundler | 2.6.9-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-io-console | 0.8.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-irb | 1.14.3-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-json | 2.9.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-minitest | 5.25.4-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-power_assert | 2.0.5-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-psych | 5.2.2-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-racc | 1.8.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rake | 13.2.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rbs | 3.8.0-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rdoc | 6.14.0-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rexml | 3.4.4-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-rss | 0.3.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-test-unit | 3.6.7-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygem-typeprof | 0.30.1-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby3.4-rubygems +1 | 3.6.9-27.amzn2023.0.8 | ALAS2023-2026-3413 |
| Amazon Linux 2023 | ruby4.0 +6 | 4.0.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-io-console | 0.8.2-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-irb | 1.16.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-json | 2.18.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-minitest | 6.0.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-power_assert | 3.0.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-psych | 5.3.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-racc | 1.8.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rake | 13.3.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rbs | 3.10.0-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rdoc | 7.0.3-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rexml | 3.4.4-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-rss | 0.3.2-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-test-unit | 3.7.5-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygem-typeprof | 0.31.1-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2023 | ruby4.0-rubygems +2 | 4.0.3-32.amzn2023.0.5 | ALAS2023-2026-3400 |
| Amazon Linux 2 | ruby +5 | 2.0.0.648-36.amzn2.0.21 | ALAS2-2026-4090 |
| Amazon Linux 2 | rubygem-bigdecimal | 1.2.0-36.amzn2.0.21 | ALAS2-2026-4090 |
| Amazon Linux 2 | rubygem-io-console | 0.4.2-36.amzn2.0.21 | ALAS2-2026-4090 |
| Amazon Linux 2 | rubygem-json | 1.7.7-36.amzn2.0.21 | ALAS2-2026-4090 |
| Amazon Linux 2 | rubygem-minitest | 4.3.2-36.amzn2.0.21 | ALAS2-2026-4090 |
| Amazon Linux 2 | rubygem-psych | 2.0.0-36.amzn2.0.21 | ALAS2-2026-4090 |
| Amazon Linux 2 | rubygem-rake | 0.9.6-36.amzn2.0.21 | ALAS2-2026-4090 |
| Amazon Linux 2 | rubygem-rdoc | 4.0.0-36.amzn2.0.21 | ALAS2-2026-4090 |
| Amazon Linux 2 | rubygems +1 | 2.0.14.1-36.amzn2.0.21 | ALAS2-2026-4090 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ruby | 3.3.13-0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | ruby +5 | 3.3.13-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | ruby4.0 +2 | 4.0.9-38.el10_2 | ELSA-2026-96233 |
| Oracle Linux 10 | ruby4.0-rubygem-mysql2 | 0.5.7-38.el10_2 | ELSA-2026-96233 |
| Oracle Linux 10 | ruby4.0-rubygem-pg | 1.6.3-38.el10_2 | ELSA-2026-96233 |
| Oracle Linux 10 | rubygem-bigdecimal | 3.1.5-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-bundler | 2.5.22-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-io-console | 0.7.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-irb | 1.13.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-json | 2.7.2-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-minitest | 5.20.0-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-power_assert | 2.0.3-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-psych | 5.1.2-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-racc | 1.7.3-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rake | 13.1.0-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rbs | 3.4.0-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rdoc | 6.6.3.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rexml | 3.4.4-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-rss | 0.3.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-test-unit | 3.6.1-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygem-typeprof | 0.21.9-16.el10_2 | ELSA-2026-96235 |
| Oracle Linux 10 | rubygems +1 | 3.5.22-16.el10_2 | ELSA-2026-96235 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ruby-3.3 +2 | 3.3.12-r10 | — |
| Wolfi rolling | ruby-3.4 +2 | 3.4.11-r5 | — |
| Wolfi rolling | ruby-4.0 +2 | 4.0.7-r6 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
GitLab CI/CD RegExp Integer Overflow Remote Code Execution
exploit/multi/http/gitlab_cicd_regexp_rce_cve_2026_97229
GitHub 9 repositories
-
jburgess-r7/CVE-2026-97229-PoC ★ 65 · Oct 13, 2026
GitLab CI lint integer-overflow RCE PoC for CVE-2026-97229, validated against the official 19.4.1 CE amd64 image
-
murat-levi/gitlab-rce-toolkit ★ 4 · Oct 29, 2026
CVE-2026-97229 + CVE-2026-110264 — GitLab Onigmo RCE Exploit Toolkit (CVSS 10.0)
-
gandli/cve-2026-97229-lab ★ 2 · Oct 17, 2026
CVE-2026-97229 GitLab CI lint regex integer overflow RCE — InstaBox version matrix reproduction & libruby gadget reverse engineering
-
Noshadi-sec/CVE-2026-97229 ★ 1 · Oct 26, 2026
CVE-2026-97229 an external exploit for GitLab CI lint regex RCE. It is used only against a live GitLab target with permission. It creates a project, pushes a malicious CI configuration, triggers the …
-
AmpedWasTaken/CVE-2026-97229-GitLab-CI-CD-Regex-Compiler-RCE ★ 1 · Oct 13, 2026
CVE-2026-97229 — GitLab CI/CD Regex Compiler RCE
-
Ghost-Bx1/cve-2026-97229-gitlab-ci-rce ★ 0 · Nov 6, 2026
CVE-2026-97229 - GitLab CE/EE CI/CD Integer Overflow RCE | CVSS 10.0 | By Gh0st-Bx1
-
Certbn/CVE-2026-97229-GitLab-CI-CD ★ 0 · Nov 4, 2026
-
emc-kk/cve-2026-97229-lab ★ 0 · Nov 3, 2026
CVE-2026-97229 lab — Onigmo repeat integer overflow RCE (GitLab CE 19.2–19.4)
-
foxcornlab/gitlab-onigmo-scanner ★ 0 · Oct 30, 2026
Detection-only triage for GitLab CVE-2026-97229 (and CVE-2026-110264): grade a self-managed GitLab version plus its Ruby, catch the Oct-12-patch and custom-Ruby traps. No payloads, no network probes.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- GitLab CE/EE < 19.2.8 / 19.3.5 / 19.4.2 - Unauthenticated RCE via Onigmo Integer Overflow http/cves/2026/CVE-2026-97229.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 19
- RLSA-2026:96233 Moderate: ruby4.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96235 Moderate: ruby security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96067 Moderate: ruby security update Rocky Linux Security Advisories · Nov 10, 2026
- ALSA-2026:96235 Moderate: ruby security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 10, 2026
- WID-SEC-2026-3858 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- WID-SEC-2026-4416 Ruby: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Nov 9, 2026
- ALSA-2026:96067 Moderate: ruby security update AlmaLinux Security Advisories · Nov 9, 2026
- ALSA-2026:96068 Moderate: ruby:3.3 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 9, 2026
- ALSA-2026:96120 Moderate: ruby:4.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 9, 2026
- ALSA-2026:96233 Moderate: ruby4.0 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 9, 2026
- ALAS2023-2026-3413 Important: ruby3.4 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3400 Important: ruby4.0 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2-2026-4090 Important: ruby security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- RLSA-2026:96120 Moderate: ruby:4.0 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 9, 2026
- RLSA-2026:96068 Moderate: ruby:3.3 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 9, 2026
- ELSA-2026-96233 Moderate: ruby4.0 security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- ELSA-2026-96235 Moderate: ruby security, bug fix, and enhancement update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- openSUSE-SU-2026:12252-1 libruby4_0-4_0-4.0.9-1.1 on GA media SUSE / openSUSE Security Updates · Oct 24, 2026
- NCSC-2026-0414 Kwetsbaarheden verholpen in GitLab NCSC-NL (Netherlands) · Oct 13, 2026
References
- https://gitlab.com/gitlab-org/gitlab/-/work_items/630686
- HackerOne Bug Bounty Report #4055749 technical-description exploit permissions-required
- HackerOne Bug Bounty Report #4058589 technical-description exploit permissions-required
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/