GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8

GitLab released critical patch versions 19.4.2, 19.3.4, and 19.2.8 for Community Edition and Enterprise Edition on October 12, 2026, addressing 22 security vulnerabilities alongside numerous bug fixes. The most severe issue, CVE-2026-97229, is a critical CVSS 10.0 integer overflow in the CI/CD regular expression compiler that could allow unauthenticated remote code execution via a crafted CI/CD config regex. Other notable fixes include a CVSS 8.7 XSS in syntax highlighting, a CVSS 8.5 authorization bypass in downstream pipeline creation, and a CVSS 8.2 cache poisoning flaw affecting CI/CD variable exposure. A known issue in 19.3.4 breaks merge request pages when the Ona integration is enabled, to be fixed in 19.3.5. Self-managed installations are strongly urged to upgrade immediately; GitLab.com is already patched and GitLab Dedicated customers need not act. The release includes database migrations causing downtime on single-node instances unless zero-downtime procedures are used.

Questions this post answers

CVE-2026-97229 is a CVSS 10.0 integer overflow vulnerability in GitLab's CI/CD regular expression compiler that could let an unauthenticated user execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration. It affects GitLab CE/EE versions 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2, and was reported through GitLab's HackerOne bug bounty program by researcher joaxcar. Teams tracking critical RCE vulnerabilities in their CI/CD stack can follow fixes like this one on daily.dev.

Upgrade to GitLab 19.4.2, 19.3.4, or 19.2.8 to fix the critical CI/CD regex vulnerability along with 21 other security issues. Note that 19.3.4 has a known bug breaking merge request pages when the Ona integration is enabled, with a fix planned for 19.3.5; GitLab.com already runs the patched version and GitLab Dedicated customers need not act. Admins planning a GitLab upgrade can track version-specific gotchas like this on daily.dev before rolling out patches.

Yes, single-node GitLab instances experience downtime during this patch because database migrations must complete before GitLab can start again. Multi-node instances can avoid downtime by following GitLab's zero-downtime upgrade procedures; 19.3.4 also includes post-deploy migrations that run after the upgrade completes. Ops teams planning maintenance windows for GitLab upgrades can keep up with release impact details on daily.dev.