GitLab critical RCE joins CISA KEV with a Nov 1 federal patch deadline

CISA added a GitLab flaw to its Known Exploited Vulnerabilities catalog on October 29 with a federal remediation deadline of November 1. The entry, CVE-2026-97229, is an integer overflow in the CI/CD regular expression compiler that lets an unauthenticated attacker execute arbitrary code on a self-managed GitLab server, rated 10.0 on the CVSS scale by Europe's CERT-EU advisory 2026-016.

The vulnerability sits in the compiler GitLab uses to process regular expressions defined in CI/CD configuration files. A specially crafted expression triggers the integer overflow, and the condition escalates to code execution on the host. Because the request path is not authenticated, no user login is required to reach the vulnerable code, which is what pushes the severity to a perfect 10.0 and what makes the entry consequential for the organizations that run self-managed GitLab Community Edition or Enterprise Edition behind their own firewall.

Related reading: Ivanti Connect Secure: CISA adds two exploited CVEs, Nov 2 patch deadline nears.

GitLab shipped patched versions 19.4.2, 19.3.5 and 19.2.8 on October 12 as an unscheduled critical patch, the same day CERT-EU published its advisory. The company said it strongly recommended every self-managed installation upgrade immediately and noted that GitLab.com was already running the patched build and that GitLab Dedicated tenants had been patched through an internal release before the public note. The 19.3.5 build was itself a revision, because the first pass at 19.3.4 broke merge request pages when the Ona integration was enabled.

The November 1 date is the remediation deadline CISA assigns to federal civilian agencies for a catalog entry that reflects confirmed exploitation in the wild. The KEV due date is the operational stick behind the addition: agencies that host affected systems are expected to have them patched or mitigated by the deadline, and the listing is what forces the fix onto a calendar rather than a wishlist.

Related reading: FOMC rate decision October 27-28: consensus expects a hold, December stays live.

For GitLab shareholders the first screen is the stock, not the CVE. GitLab last closed at $54.09, down 4.5% on the session, against a 52-week range of $18.73 to $58.01 per Yahoo Finance data retrieved November 1. The move predates this listing and is not cleanly attributable to it, but it frames the risk window the market is pricing around self-managed software that reaches into customer build pipelines.

The second-order chain matters more than the vendor is letting on. GitLab hosts the source code and the CI/CD pipeline for much of the software supply chain; a self-managed instance that a customer or a supplier controls is the trusted place where dependencies are pulled, built and shipped. An unauthenticated takeover of such a host hands an attacker the keys to the exact artifacts a downstream customer will run. GitLab.com and Dedicated struck first because the blast radius is smallest there; the exposure concentrates in the fleets that must upgrade on their own calendar.

Related reading: Gross Domestic Product Q3 Advance Estimate Explained Before the October 29 Release.

GitLab is not alone in the current KEV window. October added 36 entries to the catalog and the week of October 24 through 31 added ten, taking the total to 1,766. Within the same stretch CISA listed a Cisco Secure Firewall ASA and FTD null-pointer dereference due November 1, two Ivanti Connect Secure flaws due November 2 and November 13, and a Broadcom VMware ESX logging weakness due November 11. Ivanti and the Cisco products are the same pattern: edge appliance, short deadline.

What is dated next for GitLab traders and operators alike is the discipline of the deadline. November 1 passes today, and the market will read any subsequent call-out by CISA or by the security research community against whether the installing base actually got patched. GitLab's own cadence hands the calendar a second anchor: patch releases land on the second and fourth Wednesdays, and vulnerability details are made public on its issue tracker 90 days after the fixing release, so full technical write-ups for this integer overflow surface in January.

Related reading: The Week Ahead: Jobs report Friday, Apple and AMD earnings anchor a heavy slate.

None of this tells a reader to sell a position or to stop using GitLab. It defines the number and the date an owner has to track: a 10.0 unauthenticated remote code execution, catalogued October 29, federal deadline November 1, fixed in releases that shipped October 12. Whether the patch got to those two hundred thousand self-managed hosts in time is now the open question, and it is the one a credit analyst would ask before anything else.

This content is for informational purposes only and does not constitute financial advice. Past performance is not indicative of future results. Consult a qualified financial advisor before making investment decisions.

Sources

CISA Known Exploited Vulnerabilities catalog, CVE-2026-97229 entry, retrieved 2026-11-01

CERT-EU Security Advisory 2026-016: Critical Vulnerability in GitLab CE and EE

GitLab Critical Patch Release 19.4.2, 19.3.5, 19.2.8, October 12, 2026

CVE-2026-97229 record via cve.org

Ivanti Connect Secure KEV entries (Ivanti + Cisco/Broadcom context from the same catalog pull)

Yahoo Finance GTLB quote, retrieved 2026-11-01