Corrective updates have been released for the GitLab collaborative development platform — 19.4.2, 19.3.4, 19.2.8, which fix 24 vulnerabilities. The most critical vulnerability (CVE-2026-97229) allows arbitrary code execution on the server remotely. This issue is caused by an integer overflow in the regular expression compilation code. An unauthenticated user can exploit this vulnerability by using a specially crafted regular expression in the CI/CD configuration. The vulnerability has a severity level of 10 out of 10.
All users are strongly advised to urgently apply the update. Details of the issue are not yet disclosed and will be made public 30 days after the release of the fix (recently a similar vulnerability was fixed in the libpcre2 library, but it was not caused by an integer overflow). Information on the vulnerability has been reported to GitLab under the ongoing HackerOne bug bounty program.
Source: opennet.ru
