Live monitoring Updated 72-hour alert levelPriority Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE

CVE entry · CVE-2026-97229

CVE-2026-97229: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Description from CISA’s KEV catalog.

Our analyses

Alerts and vulnerabilities from CERT Santé, the French healthcare CERT

  1. CVSS 10

    GitLab - CVE-2026-97229

    Patch available

What to do

  1. Check whether your estate includes GitLab Community Edition and Enterprise Edition, including internet-facing devices.
  2. Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
  3. An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.

References

Other GitLab vulnerabilities

  1. CVE-2026-85706

    GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

  2. CVE-2021-22175

    GitLab Server-Side Request Forgery (SSRF) Vulnerability

  3. CVE-2021-39935

    GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability

All exploited GitLab vulnerabilities