CVE-2026-97229
Integer Overflow or Wraparound in GitLab Community Edition and Enterprise Edition. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 29 October 2026.
- Product
- GitLab Community Edition and Enterprise Edition
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- No known use in ransomware campaigns
- Vendor advisories
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
More from GitLab this year.
- CVE-2026-85706 Path Traversal, added
- CVE-2021-22175 Server-Side Request Forgery (SSRF), added
- CVE-2021-39935 Server-Side Request Forgery (SSRF), added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.