--- title: GitLab 19.4.2, 19.3.4 and 19.2.8 fix a CVSS 10.0 remote... description: GitLab released patch versions 19.4.2, 19.3.4 and 19.2.8 for Community and Enterprise Edition on October 12, 2026, fixing 22 security vulnerabilities. The... canonical: https://daily.dev/posts/gitlab-19-4-2-19-3-4-and-19-2-8-fix-a-cvss-10-0-remote-code-execution-bug-bdskbpava twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitLab 19.4.2, 19.3.4 and 19.2.8 fix a CVSS 10.0 remote code execution bug | daily.dev og:description: GitLab released patch versions 19.4.2, 19.3.4 and 19.2.8 for Community and Enterprise Edition on October 12, 2026, fixing 22 security vulnerabilities. The... og:url: https://daily.dev/posts/gitlab-19-4-2-19-3-4-and-19-2-8-fix-a-cvss-10-0-remote-code-execution-bug-bdskbpava og:image: https://api.daily.dev/og/posts/BdskbPaVa.png og:image:alt: GitLab 19.4.2, 19.3.4 and 19.2.8 fix a CVSS 10.0 remote code execution bug og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitLab 19.4.2, 19.3.4 and 19.2.8 fix a CVSS 10.0 remote code execution bug **[Collections](https://daily.dev/sources/collections)** · 3 min read · 0 upvotes · 0 comments ## Summary GitLab released patch versions 19.4.2, 19.3.4 and 19.2.8 for Community and Enterprise Edition on October 12, 2026, fixing 22 security vulnerabilities. The headline flaw, CVE-2026-97229, is a CVSS 10.0 unauthenticated remote code execution bug caused by an integer overflow in the CI/CD regular expression compiler, triggerable via a crafted regex in a CI/CD config. Other fixes include an 8.7 XSS in syntax highlighting, an 8.5 authorization bypass allowing unauthorized pipeline execution on protected branches, and an 8.2 cache poisoning bug exposing CI/CD variables. GitLab.com and Dedicated are already covered; self-managed instances must upgrade. The patches include database migrations, so single-node instances should follow the zero-downtime upgrade procedure or plan for downtime. A known issue in 19.3.4 breaks merge request pages when the Ona integration is enabled, with a fix planned for 19.3.5. ## Content GitLab shipped critical patch releases on October 12, 2026 for Community Edition and Enterprise Edition. The headline fix is CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler. It scores CVSS 10.0 and can let an unauthenticated attacker run arbitrary code on a GitLab server. ## Versions and who needs to act Affected branches are 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab.com is already patched, and GitLab Dedicated customers need to do nothing. Self-managed admins should upgrade now, outside the normal patch cycle. GitLab says there is no workaround. One wrinkle: the release announcement lists 19.3.4, but the CVE write-ups name 19.3.5 as the fixed version. 19.3.4 has a known issue that breaks merge request pages when the Ona integration is enabled, and that is due to be fixed in 19.3.5. If you're on the 19.3 branch, 19.3.5 is the one to aim for. ## How the bug works Rapid7 has published a detailed analysis and a working Python proof of concept. They reproduced full code execution against the official 19.4.1 CE image and confirmed that 19.4.2 blocks it. The chain goes roughly like this: 1. An attacker plants a malicious `.gitlab-ci.yml` containing a crafted regex. An inline regex comment smuggles a huge quantifier bound past GitLab's regex size checks. 2. A specially formed UTF-8 repository path triggers a recompilation in Ruby's Onigmo regex engine. During code generation, a signed `INT_MAX` overflows. 3. The overflow produces a miscalculated jump offset that lands in attacker-controlled character-class bitmaps. 4. Execution is then redirected through Onigmo's backtracking stack to call `system()` inside libruby. The result is arbitrary OS command execution as the GitLab git user. The attacker normally has to get the malicious CI/CD config onto the instance first. That barrier disappears on instances that allow self-registration and public project creation, and those are at the highest risk. The unauthenticated trigger is GitLab's CI lint API, which evaluates attacker-supplied CI configuration from a public project without credentials. No in-the-wild exploitation has been confirmed. With a public PoC out, I wouldn't count on that staying true for long. ## Detection Rapid7's guidance for self-managed deployments points to a few signs: - Workhorse 502 errors - Puma worker crashes - Suspicious regex patterns in CI configuration ## The rest of the release The overall release fixes 22 security vulnerabilities plus a batch of bug fixes. Beyond the critical flaw, the notable high-severity items are: - A CVSS 8.7 XSS in syntax highlighting, exploitable through crafted repositories - A CVSS 8.5 authorization bypass in downstream pipeline creation, allowing unauthorized pipeline execution on protected branches - A CVSS 8.2 cache poisoning flaw affecting raw repository files and CI/CD variable exposure - Pipeline privilege issues after a project transfer - Prompt injection into GitLab Duo AI agent instructions ## Upgrade notes The patches include database migrations. On single-node instances these cause downtime unless you follow GitLab's zero-downtime upgrade procedure, so plan the window accordingly. Given a CVSS 10.0 with a public exploit, though, I'd take the downtime. ## Questions this post answers ### What is CVE-2026-97229 in GitLab and how bad is it? CVE-2026-97229 is a CVSS 10.0 vulnerability in GitLab's CI/CD regular expression compiler caused by an integer overflow. It allows an unauthenticated attacker to achieve remote code execution simply by submitting a crafted regex in a CI/CD configuration file, with no login required, making it one of the most severe GitLab vulnerabilities disclosed. _Teams running self-managed GitLab can track critical CVEs like this one on daily.dev before they become incidents._ ### Which GitLab versions fix the CVSS 10.0 remote code execution vulnerability? GitLab fixed the flaw in patch releases 19.4.2, 19.3.4, and 19.2.8 for both Community Edition and Enterprise Edition, released October 12, 2026. These releases address 22 security vulnerabilities total, including the critical RCE plus an 8.7 XSS bug, an 8.5 authorization bypass in downstream pipeline creation, and an 8.2 cache poisoning issue affecting CI/CD variable exposure. _Self-managed GitLab operators planning upgrade windows can follow releases like this through daily.dev._ ### Does upgrading GitLab to 19.3.4 cause any known issues? Yes, GitLab 19.3.4 has a known issue where merge request pages break when the Ona integration is enabled; a fix is planned for version 19.3.5. Given the concurrent CVSS 10.0 unauthenticated remote code execution vulnerability also fixed in this release, patching immediately and working around the merge request problem is the recommended approach. _Admins weighing upgrade trade-offs against active exploits can keep tabs on GitLab advisories via daily.dev._ ## Similar posts on daily.dev - [Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264](https://daily.dev/posts/regexp-compilation-fixes-related-to-gitlab-s-cve-2026-89078-cve-2026-93577-cve-2026-97229-and-cve--tgafhy2dh) · Ruby · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#gitlab](https://daily.dev/tags/gitlab) [View this post on daily.dev](https://daily.dev/posts/gitlab-19-4-2-19-3-4-and-19-2-8-fix-a-cvss-10-0-remote-code-execution-bug-bdskbpava) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GitLab 19.4.2, 19.3.4 and 19.2.8 fix a CVSS 10.0 remote code execution bug","url":"https://daily.dev/posts/gitlab-19-4-2-19-3-4-and-19-2-8-fix-a-cvss-10-0-remote-code-execution-bug-bdskbpava","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/gitlab-19-4-2-19-3-4-and-19-2-8-fix-a-cvss-10-0-remote-code-execution-bug-bdskbpava"},"datePublished":"2026-10-12T16:15:14.532Z","dateModified":"2026-10-16T14:59:43.383Z","description":"GitLab released patch versions 19.4.2, 19.3.4 and 19.2.8 for Community and Enterprise Edition on October 12, 2026, fixing 22 security vulnerabilities. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9fc97dae2247a93bc02b0e299512c640?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9fc97dae2247a93bc02b0e299512c640?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/gitlab-19-4-2-19-3-4-and-19-2-8-fix-a-cvss-10-0-remote-code-execution-bug-bdskbpava","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cicd,gitlab","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"GitLab 19.4.2, 19.3.4 and 19.2.8 fix a CVSS 10.0 remote code execution bug"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/gitlab-19-4-2-19-3-4-and-19-2-8-fix-a-cvss-10-0-remote-code-execution-bug-bdskbpava#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-97229 in GitLab and how bad is it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-97229 is a CVSS 10.0 vulnerability in GitLab's CI/CD regular expression compiler caused by an integer overflow. It allows an unauthenticated attacker to achieve remote code execution simply by submitting a crafted regex in a CI/CD configuration file, with no login required, making it one of the most severe GitLab vulnerabilities disclosed. Teams running self-managed GitLab can track critical CVEs like this one on daily.dev before they become incidents."}},{"@type":"Question","name":"Which GitLab versions fix the CVSS 10.0 remote code execution vulnerability?","acceptedAnswer":{"@type":"Answer","text":"GitLab fixed the flaw in patch releases 19.4.2, 19.3.4, and 19.2.8 for both Community Edition and Enterprise Edition, released October 12, 2026. These releases address 22 security vulnerabilities total, including the critical RCE plus an 8.7 XSS bug, an 8.5 authorization bypass in downstream pipeline creation, and an 8.2 cache poisoning issue affecting CI/CD variable exposure. Self-managed GitLab operators planning upgrade windows can follow releases like this through daily.dev."}},{"@type":"Question","name":"Does upgrading GitLab to 19.3.4 cause any known issues?","acceptedAnswer":{"@type":"Answer","text":"Yes, GitLab 19.3.4 has a known issue where merge request pages break when the Ona integration is enabled; a fix is planned for version 19.3.5. Given the concurrent CVSS 10.0 unauthenticated remote code execution vulnerability also fixed in this release, patching immediately and working around the merge request problem is the recommended approach. Admins weighing upgrade trade-offs against active exploits can keep tabs on GitLab advisories via daily.dev."}}]} ```