<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/gitlab-critical-patch-release-19-4-2-19-3-4-19-2-8-p85p3ccd0" -->

---
title: GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8
description: GitLab released critical patch versions 19.4.2, 19.3.4, and 19.2.8 for Community Edition and Enterprise Edition on October 12, 2026, addressing 22 security...
canonical: https://daily.dev/posts/gitlab-critical-patch-release-19-4-2-19-3-4-19-2-8-p85p3ccd0
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8 | daily.dev
og:description: GitLab released critical patch versions 19.4.2, 19.3.4, and 19.2.8 for Community Edition and Enterprise Edition on October 12, 2026, addressing 22 security...
og:url: https://daily.dev/posts/gitlab-critical-patch-release-19-4-2-19-3-4-19-2-8-p85p3ccd0
og:image: https://api.daily.dev/og/posts/p85p3cCD0.png
og:image:alt: GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8

**[GitLab](https://daily.dev/sources/gitlab)** · 17 min read · 0 upvotes · 0 comments

## Summary

GitLab released critical patch versions 19.4.2, 19.3.4, and 19.2.8 for Community Edition and Enterprise Edition on October 12, 2026, addressing 22 security vulnerabilities alongside numerous bug fixes. The most severe issue, CVE-2026-97229, is a critical CVSS 10.0 integer overflow in the CI/CD regular expression compiler that could allow unauthenticated remote code execution via a crafted CI/CD config regex. Other notable fixes include a CVSS 8.7 XSS in syntax highlighting, a CVSS 8.5 authorization bypass in downstream pipeline creation, and a CVSS 8.2 cache poisoning flaw affecting CI/CD variable exposure. A known issue in 19.3.4 breaks merge request pages when the Ona integration is enabled, to be fixed in 19.3.5. Self-managed installations are strongly urged to upgrade immediately; GitLab.com is already patched and GitLab Dedicated customers need not act. The release includes database migrations causing downtime on single-node instances unless zero-downtime procedures are used.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released>

## Questions this post answers

### What is CVE-2026-97229 in GitLab and how severe is it?

CVE-2026-97229 is a CVSS 10.0 integer overflow vulnerability in GitLab's CI/CD regular expression compiler that could let an unauthenticated user execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration. It affects GitLab CE/EE versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2, and was reported through GitLab's HackerOne bug bounty program by researcher joaxcar.

_Teams tracking critical RCE vulnerabilities in their CI/CD stack can follow fixes like this one on daily.dev._

### Which GitLab versions fix the critical CI/CD regex vulnerability and are there known issues after upgrading?

Upgrade to GitLab 19.4.2, 19.3.4, or 19.2.8 to fix the critical CI/CD regex vulnerability along with 21 other security issues. Note that 19.3.4 has a known bug breaking merge request pages when the Ona integration is enabled, with a fix planned for 19.3.5; GitLab.com already runs the patched version and GitLab Dedicated customers need not act.

_Admins planning a GitLab upgrade can track version-specific gotchas like this on daily.dev before rolling out patches._

### Does upgrading GitLab to the latest critical patch release cause downtime?

Yes, single-node GitLab instances experience downtime during this patch because database migrations must complete before GitLab can start again. Multi-node instances can avoid downtime by following GitLab's zero-downtime upgrade procedures; 19.3.4 also includes post-deploy migrations that run after the upgrade completes.

_Ops teams planning maintenance windows for GitLab upgrades can keep up with release impact details on daily.dev._

## Similar posts on daily.dev

- [GitLab Critical Patch Release: 19.4.1, 19.3.3, 19.2.7](https://daily.dev/posts/gitlab-critical-patch-release-19-4-1-19-3-3-19-2-7-rdpef3qur) · GitLab · 0 upvotes · 0 comments
- [GitLab Patch Release: 19.0.2, 18.11.5, 18.10.8](https://daily.dev/posts/gitlab-patch-release-19-0-2-18-11-5-18-10-8-fmukjse7k) · GitLab · 0 upvotes · 0 comments
- [GitLab Vulnerability Under Active Exploitation Enables Unauthenticated Data Exfiltration](https://daily.dev/posts/gitlab-vulnerability-under-active-exploitation-enables-unauthenticated-data-exfiltration-5hnex7c8x) · InfoQ · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#gitlab](https://daily.dev/tags/gitlab), [#devsecops](https://daily.dev/tags/devsecops)

[View this post on daily.dev](https://daily.dev/posts/gitlab-critical-patch-release-19-4-2-19-3-4-19-2-8-p85p3ccd0)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8","url":"https://daily.dev/posts/gitlab-critical-patch-release-19-4-2-19-3-4-19-2-8-p85p3ccd0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/gitlab-critical-patch-release-19-4-2-19-3-4-19-2-8-p85p3ccd0"},"datePublished":"2026-10-12T12:40:32.009Z","dateModified":"2026-10-12T16:15:38.003Z","description":"GitLab released critical patch versions 19.4.2, 19.3.4, and 19.2.8 for Community Edition and Enterprise Edition on October 12, 2026, addressing 22 security...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"GitLab","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitLab","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3720ce340ca4435daef529abbf361b69","url":"https://daily.dev/sources/gitlab"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/gitlab-critical-patch-release-19-4-2-19-3-4-19-2-8-p85p3ccd0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cicd,gitlab,devsecops","timeRequired":"PT17M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitLab","item":"https://daily.dev/sources/gitlab"},{"@type":"ListItem","position":3,"name":"GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/gitlab-critical-patch-release-19-4-2-19-3-4-19-2-8-p85p3ccd0#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-97229 in GitLab and how severe is it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-97229 is a CVSS 10.0 integer overflow vulnerability in GitLab's CI/CD regular expression compiler that could let an unauthenticated user execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration. It affects GitLab CE/EE versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2, and was reported through GitLab's HackerOne bug bounty program by researcher joaxcar. Teams tracking critical RCE vulnerabilities in their CI/CD stack can follow fixes like this one on daily.dev."}},{"@type":"Question","name":"Which GitLab versions fix the critical CI/CD regex vulnerability and are there known issues after upgrading?","acceptedAnswer":{"@type":"Answer","text":"Upgrade to GitLab 19.4.2, 19.3.4, or 19.2.8 to fix the critical CI/CD regex vulnerability along with 21 other security issues. Note that 19.3.4 has a known bug breaking merge request pages when the Ona integration is enabled, with a fix planned for 19.3.5; GitLab.com already runs the patched version and GitLab Dedicated customers need not act. Admins planning a GitLab upgrade can track version-specific gotchas like this on daily.dev before rolling out patches."}},{"@type":"Question","name":"Does upgrading GitLab to the latest critical patch release cause downtime?","acceptedAnswer":{"@type":"Answer","text":"Yes, single-node GitLab instances experience downtime during this patch because database migrations must complete before GitLab can start again. Multi-node instances can avoid downtime by following GitLab's zero-downtime upgrade procedures; 19.3.4 also includes post-deploy migrations that run after the upgrade completes. Ops teams planning maintenance windows for GitLab upgrades can keep up with release impact details on daily.dev."}}]}
```