No. 108CISA KEV · 3 sources
GitLab Community Edition and Enterprise Edition Integer Overflow Vulnerability Added to CISA KEV
CISA added CVE-2026-97229, an integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition, to the Known Exploited Vulnerabilities Catalog with a federal remediation due date of 2026-11-01.
On this page
What's on the official record
29 October — CISA added CVE-2026-97229 to the Known Exploited Vulnerabilities Catalog (catalog version 2026.11.03). The entry describes an integer overflow or wraparound vulnerability (CWE-190) in GitLab Community Edition and Enterprise Edition. The record states an unauthenticated user could execute arbitrary code on the GitLab server via a specially crafted regular expression. CISA's remediation due date for federal agencies is 1 November 2026.
The CVE record names the fixed versions: GitLab fixed in 19.2.8 and GitLab fixed in 19.3.5, with earlier versions affected. CISA's ADP assessment marks exploitation active, automatable yes, and impact total. Ransomware use is unknown. FIRST's EPSS estimate is 0.652 (99th percentile, 2026-11-04).
Assessment
For a platform or AI-stack owner, the record lets this reader check whether any self-managed GitLab Community Edition or Enterprise Edition instance in the estate runs a version earlier than 19.2.8 or 19.3.5, and decide whether to patch, isolate, or rotate those instances before the unauthenticated code-execution path is exercised against them.
For a cyber underwriter, the record lets this reader check policyholders' GitLab estates against the fixed versions 19.2.8 and 19.3.5, and decide whether to require a control, price, or exclude coverage where an affected version remains exposed.
What would change this call
A vendor or CISA update that revises the fixed versions, a change in the SSVC exploitation or impact assessment, or evidence that ransomware use has been confirmed would change the urgency and the reader checks above.
What to check next
| Check | Why it matters |
|---|---|
| Confirm GitLab instances are at or above 19.2.8 / 19.3.5 | Earlier versions are affected per the CVE record |
| Watch for a CISA update to the KEV entry | Remediation guidance or fixed versions may be revised |
| Monitor for ransomware confirmation | Ransomware use is currently unknown |
Confidence
The record is a CISA KEV entry copied from the official catalog, with the CVE record and NVD as named sources. The fixed versions, dateAdded, dueDate, and SSVC values are stated directly in the row. EPSS is FIRST's model estimate, not observed exploitation, and the SSVC values are CISA's ADP assessment, not observed exploitation.
Sources
[1] GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-97229
[2] CVE record CVE-2026-97229 — https://www.cve.org/CVERecord?id=CVE-2026-97229
[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Entry
- 108
- Action date
- Published
- Record
- CISA KEV · 3 sources
- Written for
- Platform or ai stack owner
- Cyber underwriter
AI assistants read this note with get_note cyb-20261029-cve-2026-97229. Connect yours