VendorGitLab security releases
GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8Type Vulnerability
GitLab Community Edition and Enterprise Edition
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
7 sourcesCVE-2026-97229
At a glance
Medium
7-day window, from the last update
ActiveConfirmed in-the-wild exploitation
Evidence-weighted, not popularity
Signal
Actively exploited in the wild — prioritise confirming exposure.
Why Medium
Medium rather than High: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on Ruby-lang Ruby, treat it as High.
Briefing
- Organisations using GitLab should verify if they are running affected versions and apply updates promptly.
- The confirmed exploitation of this vulnerability highlights the need for urgent patch management processes.
Questions to ask IT
- Do we run Ruby-lang Ruby and GitLab Community Edition and Enterprise Edition, and is every instance on a fixed release (19.2.8, 19.3.5 or 19.4.2, or later)?
- Is any of it reachable from the internet?
- Have we checked whether it has already been used against us?
- If it is not yet patched, what mitigation is in place, and will the fix be done by 14 Nov?
Next steps
- Confirm exposure and remediation status for affected products
Vulnerability facts
Full CVE detail CVE-2026-97229- 10.0 · CriticalExploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability, and it can reach beyond the vulnerable system.CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Listed: attacks using it have been seen (on the catalogue since )
- Elevated attack likelihood (~65.2% in 30 days)
- 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2
- 19.2.8, 19.3.5, 19.4.2
Versions are as the CVE record states them; check the vendor advisory before planning a fix.
- Versions 19.4.2, 19.3.5, and 19.2.8 of GitLab Community Edition and Enterprise Edition address the vulnerability.
- CVE-2026-97229 involves an integer overflow or wraparound vulnerability affecting merge request pages.
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- GitLab released updated versions to address a vulnerability affecting merge request pages when the Ona integration is enabled.
- A vulnerability (CVE-2026-97229) has been confirmed as exploited in the wild.
Read the original reportGitLab security releases(opens in a new tab)
Products and services involved
- Ruby-lang Ruby90% match confidence · CVE-2026-97229
- GitLab Community Edition and Enterprise Edition98% match confidence · CVE-2026-97229
3 reports
Part of GitLab vulnerability disclosures
Same event, different frames
Distinct often headline the same incident differently.
ResearcherRapid7 Blog
CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLabOfficialCISA Known Exploited Vulnerabilities
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound VulnerabilityPulse
Last checked 21h ago · Next recheck 8 Nov 2026, 17:36 UK time
Update
7 Nov 2026, 17:36 UK time · 21h ago
held at 27.7%; ranking metadata was updated.
Listed on the — prioritise confirming exposure and patching.
Drag to pan · Ctrl / ⌘ + scroll or pinch to zoom16 events
Sources
- GitLab security releasesVendor
GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8
CVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLab
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- SecurityWeekNews
Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
CVE-2026-97229: elevated exploitation probability
- GitLab security releasesVendor
GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
- ProbableSummary fact75% confidence
On 12 October 2026, we released versions 19.4.2, 19.3.5, 19.2.8 for GitLab Community Edition (CE) and Enterprise Edition (EE). 19.3.4 had a bug that affected merge request pages when the Ona integration was enabled.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-97229
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2026-97229 is confirmed as exploited in the wild (US known-exploited catalogue)
- ConfirmedEstimated attack likelihood95% confidence
CVE-2026-97229 has an estimated ~27.7% chance of attack in 30 days (98.1th percentile) as of 2026-11-03 — probability signal, not confirmed exploitation