GitLab released versions 19.4.2, 19.3.4 and 19.2.8 for Community Edition and Enterprise Edition on October 8, 2026. Its official critical-patch notice says these versions contain security and bug fixes and recommends upgrading affected self-managed installations.
The highest-rated issue is CVE-2026-97229, an integer-overflow flaw in the CI/CD regular-expression compiler. GitLab says that, under certain conditions, an unauthenticated user could have executed arbitrary code on a GitLab server through a specially crafted regular expression in a CI/CD configuration. The company assigns it a CVSS 3.1 score of 10.0.
For that issue, the notice lists GitLab CE and EE versions from 19.1 before 19.2.8, the 19.3 line before 19.3.4, and the 19.4 line before 19.4.2 as affected. Administrators should distinguish the version ranges for this flaw from other issues in the same patch notice; several other fixes cover earlier release lines.
The hosting model changes the action needed. GitLab says GitLab.com is already running the patched version and GitLab Dedicated customers do not need to take action. The immediate upgrade recommendation is directed at self-managed installations, rather than every person who uses GitLab.
The release also fixes other issues, including cross-site scripting through repository content and pipeline-related privilege problems. GitLab says that when a vulnerability description does not name a particular deployment type, all deployment types are affected. The notice is an October 8 release, not a new October 12 patch.
Limits: the notice describes conditions that could allow attacks and provides affected-version ranges. This brief does not establish exploitation in the wild or compromise of any particular installation. The CVSS score is a severity measure, not proof that an attack has occurred. Administrators should use the official notice to match their release line and deployment to the relevant fixes.