CRITICALCVSS v3.1 10.0Actively exploited · CISA KEV since 2026-10-29Vulnerability

CVE-2026-97229

GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

Properties

Vulnerability name
GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
Epss score
0.18427
Cvss score
10
Due date
2026-11-01
Retrieved at
2026-10-29T23:57:21+00:00
Date added
2026-10-29
Score
10
Cvss vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
First seen by Signal
2026-10-18T13:37:47+00:00
Vendor project
GitLab
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published at
2026-10-13T02:17:00.840
Last modified
2026-10-14T13:55:26.987
Epss percentile
0.97229
Severity
CRITICAL
Licence
FIRST EPSS: free to use; attribution requested in publications or products (FAQ)
Product
Community Edition and Enterprise Edition
Nvd fetched at
2026-10-20T00:24:19.781460+00:00
Cvss severity
CRITICAL
Signal source
FIRST EPSS

Related Entities (6)

AFFECTS_PRODUCT (2)

→[Product]gitlab gitlab
→[Product]gitlab gitlab

MENTIONED_IN (2)

→[Campaign]NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
→[Campaign]CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild

DESCRIBES (1)

←[KEVEntry]GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

HAS_WEAKNESS (1)

→[Weakness]Integer Overflow or Wraparound

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-97229 (CVSS v3.1 10) — Ninja Signal Threat Intelligence | Ninja Signal