{"id":"EM-20261029-FTDW","url":"https://cyber.eventmonitor.net/incident/EM-20261029-FTDW/","type":"cve","title":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability","subtitle":"CVE-2026-97229","subject":"CVE-2026-97229","status":"Confirmed","severity":"high","affected":["GitLab Community Edition and Enterprise Edition"],"headline":"0 hours from first report to confirmed exploitation.","born":"2026-10-29T12:00:00.000Z","firstSignal":"2026-10-29T12:00:00.000Z","lastSignal":"2026-10-30T07:27:05.000Z","updated":"2026-11-04T09:24:33.782Z","revision":3,"life":[{"status":"Born","at":"2026-10-29T12:00:00.000Z","why":"second independent source: C2 CISA Cybersecurity Advisories"},{"status":"Developing","at":"2026-10-29T12:00:00.000Z","why":"signals keep joining"},{"status":"Confirmed","at":"2026-10-29T12:00:00.000Z","why":"CISA added it to Known Exploited Vulnerabilities"}],"changeLog":[{"at":"2026-10-29T12:00:00.000Z","what":"First signal: C1 CISA Known Exploited Vulnerabilities"},{"at":"2026-10-29T12:00:00.000Z","what":"Born: second source, C2 CISA Cybersecurity Advisories. Page EM-20261029-FTDW created."},{"at":"2026-10-29T12:00:00.000Z","what":"Status: Confirmed (CISA added it to Known Exploited Vulnerabilities)"},{"at":"2026-10-30T07:27:05.000Z","what":"Source joined: C130 The Hacker News"}],"stages":[{"name":"Disclosed","at":"2026-10-13T02:17:00.840Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-10-13T02:17:00.840Z","detail":"CVSS 10 · EPSS 27.7%"},{"name":"Exploited","at":"2026-10-29T12:00:00.000Z","detail":"C1 CISA KEV, fix by 2026-11-01"},{"name":"Advisories","at":"2026-10-29T12:00:00.000Z","detail":"1 government and CERT sources"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"When fixed: KEV deadline 2026-11-01, then 14 quiet days"}],"signals":[{"at":"2026-10-29T12:00:00.000Z","source":"C1","sourceName":"CISA Known Exploited Vulnerabilities","role":"Exploited List","severity":3,"title":"CVE-2026-97229 added to KEV: GitLab Community Edition and Enterpri e Edition Integer Overflow or Wraparound Vulnerability","text":"GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"at":"2026-10-29T12:00:00.000Z","source":"C2","sourceName":"CISA Cybersecurity Advisories","role":"Government","severity":3,"title":"CISA Add  Two Known Exploited Vulnerabilitie  to Catalog","text":"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-97229 GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound vulnerability CVE-2026-76418 Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability These types","url":"https://www.cisa.gov/news-events/alerts/2026/10/29/cisa-adds-two-known-exploited-vulnerabilities-catalog"},{"at":"2026-10-30T07:27:05.000Z","source":"C130","sourceName":"The Hacker News","role":"Research & News","severity":2,"title":"CISA Add  Actively Exploited GitLab RCE and Ci co Firewall DoS Flaw  to KEV","text":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise","url":"https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html"}],"crowd":[],"reference":{"nvd":{"published":"2026-10-13T02:17:00.840","score":10,"severity":"CRITICAL","desc":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expressi","product":"Gitlab","seen":1793783074499},"kev":{"added":"2026-10-29","due":"2026-11-01","ransomware":"Unknown","vendor":"GitLab","product":"Community Edition and Enterprise Edition","name":"GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability"},"epss":{"epss":0.27692,"pct":0.98089,"at":1793783074499},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}