GitLab regex RCE CVE-2026-97229/110264: patch

What happened

GitLab fixed two critical flaws, nine days apart. Both are integer overflows in how Ruby’s regular-expression engine, Onigmo, compiles a crafted pattern. Both are rated CVSS 10.0 and let an unauthenticated attacker run code on the GitLab server. Both were reported by joaxcar through GitLab’s HackerOne programme.

CVE-2026-97229, fixed on 12 October 2026 in 19.4.2, 19.3.5 and 19.2.8. It affects 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. The pattern arrives through a CI/CD configuration (GitLab). Rapid7 found that the regex passes GitLab’s validation as a compact ASCII pattern, then Onigmo recompiles it against a UTF-8 repository path and the size calculation overflows. That gives command execution as the git user. The attacker needs to push a .gitlab-ci.yml to a public project. Any ordinary account can do that on instances where users can sign up and create projects (Rapid7).
CVE-2026-110264, fixed on 21 October 2026. It affects “all versions from 7.0” up to the fixed builds: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 and 19.5.1 (GitLab). The 12 October builds do not contain this fix.

On 23 October, Ruby released 4.0.9, 3.4.12 and 3.3.13 with the Onigmo fixes for both CVEs and two related GitLab CVEs (Ruby).

CVE-2026-97229 is exploited. CISA added it to the Known Exploited Vulnerabilities catalog on 29 October 2026, with a federal due date of 1 November (CISA KEV). Alpine Linux disclosed an attempt against its own GitLab. The attacker started probing on 20 October, crashed GitLab workers eight times on 21 October, downloaded Alpine’s GitLab container image, and tried again on 25 and 26 October. Alpine found no evidence it succeeded, said it could not rule it out, and rebuilt the instance from scratch. Its packages and releases were checked and not tampered with (Alpine Linux). No exploitation of CVE-2026-110264 has been reported, and it was not in the KEV catalog as of 30 October.

Am I affected?

Every self-managed GitLab older than the 21 October builds is affected by CVE-2026-110264. Versions 19.2 to 19.4 before the 12 October builds are also exposed to the exploited CVE-2026-97229.

bash

# Omnibus (Linux package) installs
sudo gitlab-rake gitlab:env:info | grep -A2 '^GitLab information'
cat /opt/gitlab/embedded/service/gitlab-rails/VERSION

# Docker installs (container name varies)
docker exec gitlab cat /opt/gitlab/embedded/service/gitlab-rails/VERSION

# Any install, over the API, with a personal access token
curl -s --header "PRIVATE-TOKEN: $TOKEN" https://gitlab.example.com/api/v4/version

# The Ruby GitLab actually runs (Omnibus bundles its own)
/opt/gitlab/embedded/bin/ruby -v

Other Ruby apps can be affected too. Ruby says an app is at risk if it compiles regexes from strings an attacker controls, through Regexp.new, Regexp.union, Regexp.compile or interpolation like /#{input}/. Regexp.timeout does not help, and length limits are not reliable (Ruby).

bash

grep -rnE 'Regexp\.(new|union|compile)|/#\{' --include='*.rb' app lib

What to do now

Upgrade to a 21 October build: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. GitLab notes single-node instances have downtime while migrations run (GitLab).
Upgrade Ruby if you do not use the Omnibus package or official image, and run apk upgrade (or your distro’s equivalent) on hosts with other Ruby apps.
Stopgap if you cannot patch today: turn off open sign-up, stop untrusted users creating or pushing to public projects, and restrict anonymous access to public projects. Rapid7 says this blocks the demonstrated path for CVE-2026-97229 only; it does not fix the compiler (Rapid7).
Look for attempts. GitLab published detections, including “Onigmo native worker crash”, “ci lint workhorse worker crash” and “Org mode render error burst” (12 October post; 21 October post). Search logs from early October for worker crashes, bursts of CI lint errors and newly registered accounts pushing CI files.
If you saw crashes, act as Alpine did. A successful exploit may leave no trace. Rebuild the server, reset passwords, replace GitLab’s secret keys, rotate runner registration and CI/CD tokens, and check that nothing in your repositories or package registry changed.

Why this is part of the Vulnpocalypse

Two CVSS 10 bugs in the same narrow code path, nine days apart, from one researcher, show how a bug class gets mined once someone finds the seam. The first fix closed one route into Onigmo; the second showed the engine itself was the problem. That pushed the fix down a layer, into Ruby, so other Ruby apps now need the patch too.

The KEV due date of 1 November also shows how short the window is. Patch day was 12 October; the first attack on a well-run open-source project came eight days later.

Sources

GitLab’s release posts on about.gitlab.com now redirect to docs.gitlab.com.

Related advisories