CISA Flags Exploited GitLab CI Flaw and Sets November 1 Fix Date

CISA added CVE-2026-97229 to its exploited-vulnerabilities catalog on October 29, with a November 1 action date and forensic triage required. Crafted regular expressions in GitLab CI configuration can corrupt the Ruby Onigmo compiler and, under certain conditions, give an unauthenticated attacker code execution on a vulnerable GitLab server. This is a server-side configuration-parsing problem; a healthy pipeline-job dashboard is a poor proxy for server health.

For self-managed GitLab CE and EE, 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected. Inventory installed versions, upgrade affected servers to a supported patched release, and confirm the version running after the change. GitLab.com and GitLab Dedicated were patched by GitLab. Review available GitLab security detections for CI regex and CI Lint activity, and preserve correlated CI Lint, GraphQL, Workhorse, application-error and worker-crash evidence for incident triage. A quiet detection feed alone is a blind spot for a previously exposed server.

Ruby also fixed the underlying compiler issue. For separate Ruby apps that compile attacker-controlled patterns, the project recommends Ruby 4.0.9, 3.4.12, or 3.3.13 or later. Regexp.timeout does not prevent these memory-corruption bugs. Confirm both the running GitLab release and the investigation of the vulnerable period before treating the server as routine maintenance.