GitLab's CI/CD Regex Compiler Has a CVSS 10.0 — and It's Being Exploited Right Now

If you run GitLab — self-hosted or managed — this one matters.

CVE-2026-97229 is a CVSS 10.0 integer overflow in GitLab's CI/CD regex compiler.
An unauthenticated attacker sends a crafted regex pattern in a pipeline
definition. The compiler overflows, corrupts the heap, and execution follows.
No login required. No pipeline needs to run.

CISA added it to the Known Exploited Vulnerabilities catalog with a remediation
deadline of November 1, 2026. Active exploitation confirmed against Alpine Linux
infrastructure.

What makes this different from most CVEs:

The attack surface is a .gitlab-ci.yml file — something every developer on
your team touches. On a self-hosted instance, anyone who can submit a merge
request can trigger it. On a public project, that's anyone on the internet.

The fix exists: GitLab 17.8.1.

If you're running anything below that, you're exposed. The patch ships with
GitLab 17.8.1 and later. Self-hosted admins need to update manually —
GitLab.com was patched by the vendor.

If you can't patch immediately:

• Disable public project creation
• Restrict who can submit merge requests on public repos
• Watch for unusual CI job failures or unexpected process spawns from the runner

I wrote a full technical breakdown covering the integer overflow mechanism,
the heap corruption path, exploitation against Alpine, and the KEV timeline:

👉 https://threataft.com/articles/gitlab-cve-2026-97229-regex-rce

Cross-posted from ThreatAft with canonical URL set to the original.