GitLab’s October 12 advisory addresses CVE-2026-97229, a critical integer-overflow issue in its CI/CD regular-expression compiler. Under specified conditions, an unauthenticated user could execute code on the server. The current advisory recommends releases 19.4.2, 19.3.5 or 19.2.8 for the affected supported branches.
The 19.3 recommendation matters: GitLab says 19.3.4 had a merge-request-page problem when the Ona integration was enabled, corrected in 19.3.5. GitLab.com is already patched, and Dedicated customers need no action, according to the company. Self-managed operators should consult the current advisory and their applicable upgrade path.
NAOAT analysis
This is a case where copying a version number from an early alert can leave a change ticket behind the vendor’s current instructions. The ticket should identify the advisory revision used to select the target release, with another check immediately before the maintenance begins. That gives the operator a chance to catch a replacement build without losing the record of the original decision.
Verification should reflect the work the platform supports. A successful restart is useful evidence, but a development team also needs to know that a representative pipeline can be evaluated and run, a merge request can be reviewed, and normal access controls still apply. Those checks should use benign test projects and approved procedures, not attempts to reproduce the vulnerability on production.
The handover to project owners should distinguish service restoration from security investigation. Installing a corrected version establishes the new software state; it does not establish what happened before the update. If an organization has separate reasons to suspect intrusion, that investigation needs its own evidence and scope. A complete operational record connects the installed release, functional checks and any unresolved investigation, so the next person does not mistake one completed task for all three.