Gistline
Get GistlineGet
Menu
GitLab patches maximum-severity CVE-2026-97229 code execution flaw
shattered.io

GitLab patches maximum-severity CVE-2026-97229 code execution flaw

The gist

GitLab released 19.4.2, 19.3.5 and 19.2.8 on Oct 12 to fix CVE-2026-97229, a CVSS 10.0 remote code execution bug.
The flaw sits in Ruby's regex engine, so any app compiling untrusted patterns may need the fix.

How it unfolded

  1. Sep 23, 2026GitLab 19.4.1, 19.3.3 and 19.2.7 fix CVE-2026-89078 and CVE-2026-93577, regex flaws sharing the same Ruby Onigmo fixes.
  2. Oct 12, 2026GitLab 19.4.2, 19.3.5 and 19.2.8 fix CVE-2026-97229; CERT-EU publishes advisory 2026-016 for GitLab.
  3. Oct 21, 2026GitLab 19.5.1 and backports down to 18.11.13 fix CVE-2026-110264.

Sources

Read the full story in the app Gistline — free on the App Store