On 29 October 2026 the US cybersecurity agency CISA added CVE-2026-97229, a critical flaw in self-managed GitLab Community and Enterprise Edition, to its Known Exploited Vulnerabilities (KEV) catalog (catalog version 2026.10.29). According to the KEV data as reported by hol.org, US federal civilian agencies must fix it by 1 November 2026; use by ransomware is listed as unknown.
The bug is an integer overflow in the regular expression compiler used by GitLab CI/CD, rated CVSS 10.0. Its root cause is in Onigmo, the regex engine built into Ruby. GitLab fixed it on 12 October in 19.2.8, 19.3.5 and 19.4.2; GitLab.com is already patched and GitLab Dedicated customers need do nothing. Rapid7, which published a working proof-of-concept on 13 October, found that the attacker needs to push a malicious .gitlab-ci.yml to a public project, and that code then runs as GitLab's git user. Where anyone can sign up and create projects, that requirement is effectively removed.
A real attack attempt: Alpine Linux reported that on 20–21 October a newly registered account sent crafted CI configurations to its GitLab server, crashing worker processes 8 times. Alpine had upgraded to 19.3.4 instead of 19.3.5 by mistake, and its later 19.3.6 image still used a standard, unfixed Ruby. Alpine found no evidence the attack succeeded but cannot rule it out, so it rebuilt the server, reset all passwords and replaced GitLab's secret keys. It says its releases and packages were not tampered with.
Why upgrading may not be enough: GitLab applies the Ruby fix only in its official packages and images. Installs from source, distro packages or third-party images that bring their own Ruby also need Ruby 3.3.13, 3.4.12 or 4.0.9 or later. Per hol.org, Ruby 3.2 is end of life and gets no fix.
Public details of other attacks are limited; CISA's listing does not say who is exploiting the flaw or how widely.
