CVE-2026-97229

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-97229
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97229.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-97229
Aliases
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CGA (90)
CLSA (8)
DEBIAN (1)
MINI (9)
openSUSE (1)
UBUNTU (1)
Related
Published
2026-10-13T01:05:46Z
Modified
2026-11-05T13:08:47Z
Severity
  • 10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Integer Overflow or Wraparound in GitLab
Details

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Database specific 
{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-190"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97229.json"
}
References

Affected packages

Git / github.com/ruby/ruby

Affected ranges

Type
GIT
Repo
https://github.com/ruby/ruby
Events
Introduced
5124f9ac7513eb590c37717337c430cb93caa151
Fixed
af48f08f2113db1cc4ee171f34e399d7a902151b
Introduced
f45010833071b953744658842369e3496dfacb48
Fixed
366f5fdc00cbd2e7997e03b6654d10163ff19bad
Introduced
553f1675f3a9cece340b90f374a4245dccac2272
Fixed
60c3d71bfbf9790229c682e26f8ec968f078c7da
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.3.0"
                },
                {
                    "fixed": "3.3.13"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "3.4.0"
                },
                {
                    "fixed": "3.4.12"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "4.0.8"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
68485a1eb627c9a992f266263157327649822db3
Fixed
9a42f777a0147768457ebe684e13e69d54eee652
Introduced
8f83039bebbbb61d3b7b8b7e2342d1deec1e14c6
Fixed
ce7cbf1bcc4e49e98f209097d5081030e30410c5
Introduced
fa703f93afaf1133cd263f6aa0e91d284d7f1ebf
Fixed
9c053f678a4924425869b1b9e4bca3a44e45edf7
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "range": [
                {
                    "introduced": "19.2.0"
                },
                {
                    "fixed": "19.2.8"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "19.2.0"
                },
                {
                    "fixed": "19.2.8"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "range": [
                {
                    "introduced": "19.3.0"
                },
                {
                    "fixed": "19.3.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "19.3.0"
                },
                {
                    "fixed": "19.3.5"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "range": [
                {
                    "introduced": "19.4.0"
                },
                {
                    "fixed": "19.4.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "range": [
                {
                    "introduced": "19.4.0"
                },
                {
                    "fixed": "19.4.2"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

v19.*
v19.2.0-ee
v19.3.0-ee
v19.4.0-ee
Other
v3_3_0
v3_3_1
v3_3_10
v3_3_11
v3_3_12
v3_3_2
v3_3_3
v3_3_4
v3_3_5
v3_3_6
v3_3_7
v3_3_8
v3_3_9
v3_4_0
v3_4_1
v3_4_10
v3_4_11
v3_4_2
v3_4_3
v3_4_4
v3_4_5
v3_4_6
v3_4_7
v3_4_8
v3_4_9
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.5
v4.0.6
v4.0.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97229.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "131492879161308528656706201693006189213",
                "320276122247927977087964944943919935352",
                "157614422546552286445818292047284007252",
                "29305783042846336151165948536933763584"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-97229-c2eda66a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/ruby/ruby/commit/366f5fdc00cbd2e7997e03b6654d10163ff19bad",
        "target": {
            "file": "regcomp.c"
        }
    }
]
vanir_signatures_modified 
"2026-11-05T13:08:47Z"