A critical unauthenticated remote code execution vulnerability in GitLab moved from CISA KEV addition to confirmed real-world exploitation in under 24 hours. CVE-2026-97229, rated CVSS 10.0, lives in the Onigmo regex engine bundled with GitLab's Ruby runtime. An integer overflow in the regex parser lets an unauthenticated attacker trigger RCE with no prior access required. CISA added it to the Known Exploited Vulnerabilities catalog on October 29, with a Federal Civilian Executive Branch (FCEB) remediation deadline of November 1.
Confirmed real-world impact
Alpine Linux, which runs a self-hosted GitLab instance, reported 8 worker process crashes on October 20 and 21. They have since attributed these crashes to CVE-2026-97229. The crashes were severe enough that the Alpine Linux team rebuilt the entire cluster from scratch rather than attempting in-place recovery. This is a named organization with a public infrastructure logging what active exploitation looks like before the CVE was widely known.
Exposure scope
Censys counts 25,766 internet-exposed GitLab instances. Self-hosted GitLab is common in software companies, government agencies, and research institutions that prefer to keep source code on their own infrastructure. Any instance running an unpatched version is a potential target.
Affected versions and patches
GitLab has released fixes in versions 19.2.8, 19.3.5, and 19.4.2. Both GitLab CE and EE are affected. GitLab.com (the SaaS offering) has already been patched. The vulnerability is in the bundled Onigmo regex library, not GitLab application code itself, so it requires a full package update rather than a configuration-only fix.
Remediation steps
Update to 19.2.8, 19.3.5, or 19.4.2 immediately. If your release line is earlier than 19.2, check GitLab's security advisories for backport status and plan to upgrade to a supported version. FCEB agencies are under a hard November 1 deadline. Non-federal organizations should treat this with the same urgency given the active exploitation confirmation.
If you cannot patch today
Restrict GitLab to internal network access. If your instance is internet-facing and patching today is not possible, put it behind a VPN or internal-only firewall rule. An unauthenticated RCE at CVSS 10.0 with confirmed active exploitation is not a candidate for the next maintenance window.
Durable lesson
Bundled third-party libraries in developer tools are a persistent source of critical vulnerabilities. GitLab ships its own Ruby runtime with a bundled regex engine; most administrators do not think of the regex library when they consider GitLab's attack surface. Tracking which libraries a tool bundles matters as much as tracking the tool version itself.