A GitLab regex bug is now under attack. Its root sits in Ruby itself.
By Lior AharonovFounder, 7IT Solutions ·
What happened
On Thursday, 29 October, CISA added GitLab flaw CVE-2026-97229 to its exploited list, based on evidence of active exploitation. Ruby says the bug is an integer overflow in its regex engine that GitLab found could turn a crafted pattern, such as one in CI configuration, into code execution on GitLab servers. GitLab fixed it in 19.4.2, and Ruby shipped 4.0.9, 3.4.12 and 3.3.13 on 23 October.
Why it matters
Your GitLab server holds the source, the CI secrets and the deploy keys. Ruby says the root bug sits in its own regex engine, so any Ruby app that compiles a pattern from user input can reach it too.
What to do
Upgrade self-managed GitLab to the current patch release today, 19.4.2 or later on the 19.4 line, and move your other Ruby apps to Ruby 4.0.9, 3.4.12 or 3.3.13.
My take
Lior Aharonov
Founder, 7IT Solutions
A patch you have not installed is just a note telling attackers where to look.
I've seen this before
I've seen this movie before: the FTC says Equifax was alerted in March 2017 to a critical vulnerability, ordered its systems patched within 48 hours, and only found the unpatched database in July 2017.
FTC: Equifax to pay $575 million as part of settlement related to 2017 data breach ftc.gov
Sources
| CISA adds two known exploited vulnerabilities to catalog (29 October) | cisa.gov |
| Ruby: Regexp compilation fixes related to GitLab's CVEs | ruby-lang.org |
Researched with AI tools; every fact is checked against the linked sources.