GitLab CVE-2026-97229: the first October CI bug, not the second
On 12 October GitLab fixed CVE-2026-97229: an overflow while compiling a regular expression in CI configuration. Also scored 10, also unauthenticated. The version range is narrower than the 21 October bug.
People mix this bug up with the next one, because both involve regular expressions and both score 10. CVE-2026-97229 was fixed on 12 October in 19.4.2, 19.3.5, and 19.2.8. Branches 19.2, 19.3, and 19.4 before those builds are affected. Older lines outside that range are not covered by this particular advisory. That does not make an old GitLab "safe": nine days later a second critical bug landed with a much wider version list.
In plain language
CI configuration can carry an expression that GitLab's compiler parses with an overflow. An outsider does not need an account. If your instance is on the internet and sits on 19.2-19.4 without the 12 October patch, the window was open. If you are already on 19.2.8, you are closed for this bug and still open to CVE-2026-110264 until 19.2.9.
The practical conclusion is dull, which is why people skip it. Read the exact build number. "We are on nineteen" answers neither advisory. And do not keep in CI variables the secrets you need to rebuild production, if the instance faces the internet: a patch lowers the odds, it does not make secrets in CI a good idea.
Related Lexora services
Two GitLab numbers, one mix-up
We can match the build against both advisories. "Already patched" often means only the first one.