# GitLab urges immediate patching for critical server code execution flaw

_Published Monday, October 12, 2026 at 10:07 AM EDT · Security · Latest · Tier 1 — Major_

![GitLab urges immediate patching for critical server code execution flaw — Primary](https://www.bleepstatic.com/content/hl-images/2026/10/12/GitLab.jpg)

GitLab urged self-managed users to patch a maximum-severity vulnerability that could allow an unauthenticated attacker to execute arbitrary code on a server under certain conditions. CVE-2026-97229 involves an integer overflow in the compiler that processes regular expressions in CI/CD pipeline configuration files; a specially crafted expression can exploit insufficient validation.

The affected Community and Enterprise Edition releases are 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. GitLab recommends immediate upgrades to the patched versions. GitLab.com already runs a patched version, and GitLab Dedicated customers do not need to take action.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/gitlab-warns-of-max-severity-rce-flaw-in-regex-compiler-engine/)

---
Canonical: https://techandbusiness.org/newswire/Oqiy_vhSsyQNHTHdcDn46S
Published: 2026-10-12T14:07:50.143Z
Story chronology: 2026-10-12T13:09:09.000Z
Retrieved: 2026-10-12T16:38:35.136Z
Publisher: Tech & Business (techandbusiness.org)