GitLab CVE-2026-97229 (unauthenticated RCE via a crafted regex in CI/CD config) was added to CISA KEV on Oct 29, 2026. Is upgrading GitLab enough, and what if I run GitLab on my own Ruby?

What it is: CVE-2026-97229 (CVSS 10) is an integer overflow in the Onigmo regular expression engine that GitLab uses when compiling regexes from CI/CD configuration. A crafted pipeline config can let an attacker run code on a self-managed GitLab server; on instances with open sign-up, a newly registered account is enough. GitLab fixed it on October 12/13, 2026; public exploit code followed, Alpine Linux reported exploitation attempts against its own GitLab server on October 20-21, and CISA added it to KEV on October 29 (federal deadline November 1). A related bug in the same engine, CVE-2026-110264, was fixed on October 21. Am I affected: - Self-managed GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2 (and for CVE-2026-110264, anything before the October 21 patch releases). GitLab.com and Dedicated are patched. - Installations that run GitLab on a system or custom Ruby (source installs, some distribution packages, Alpine's package) also need a fixed Ruby: 3.3.13, 3.4.12 or 4.0.9 or later, per the Ruby project. Omnibus and official Docker images ship their own patched Ruby. - CISA notes other Ruby apps that compile untrusted regular expressions may be affected by the same Onigmo bug. Fix: 1. Upgrade GitLab to the latest patch release on your line (at least the October 21 release, which covers both CVEs: e.g. 19.5.1, 19.4.3, 19.3.6, 19.2.9). 2. If you don't use the bundled Ruby, upgrade Ruby to 3.3.13 / 3.4.12 / 4.0.9+ and restart GitLab. Rebuild container images from fresh base images (Alpine's 19.3.6 image is only fixed if pulled on or after October 27). 3. Restrict sign-ups (admin approval, allowed domains) so strangers can't create accounts and pipelines. 4. If the instance was internet-facing and unpatched, check for crashing Puma/Sidekiq workers, new accounts creating pipelines, unknown processes and files, and rotate secrets stored in GitLab (CI variables, runner tokens, deploy keys). Verify: Admin area shows a fixed version; for non-Omnibus installs, ruby -v shows a fixed Ruby. Sources: https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/ https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html