GitLab CI/CD regex integer overflow enables unauthenticated RCE
An integer overflow in GitLab's CI/CD configuration regex validation lets unauthenticated attackers execute arbitrary code on affected CE and EE instances via a crafted pipeline expression.
- Vendor
- GitLab
- Product
- GitLab CE/EE
- CVSS
- 10.0
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
An integer overflow in GitLab’s CI/CD configuration regex validation layer allows an unauthenticated remote attacker to execute arbitrary code on the server. The flaw is triggered by a specially crafted regular expression in a .gitlab-ci.yml or pipeline configuration input, reachable without authentication on both Community Edition and Enterprise Edition installations.
Affected versions:
- GitLab CE/EE 19.2.x before 19.2.8
- GitLab CE/EE 19.3.x before 19.3.5
- GitLab CE/EE 19.4.x before 19.4.2
Patched versions: 19.4.2, 19.3.5, and 19.2.8. GitLab.com was updated at disclosure. Self-hosted instances require a manual upgrade.
No confirmed in-the-wild exploitation was reported as of October 13, 2026. GitLab’s advisory provides full version tables and upgrade paths.
