The vulnerability is an integer overflow or wraparound in the regex compiler used by GitLab during parsing of CI/CD configuration files. When an authenticated user submits a specially crafted regular expression, the overflow can lead to arbitrary code execution on the GitLab server. This flaw is classified as CWE-190 and allows a compromised server to be fully controlled by the attacker, impacting confidentiality, integrity, and availability.

Affected versions include GitLab Community Edition and Enterprise Edition from 19.2.x before 19.2.7, 19.3.x before 19.3.3, and 19.4.x before 19.4.1. All installations of GitLab running those versions are vulnerable.

The CVSS score of 9.9 indicates a critical severity, and while an EPSS score is not reported, the absence of an EPSS rating does not reduce the potential for exploitation. The issue is not listed in the CISA KEV catalog. An attacker requires authenticated access with permission to modify CI/CD configurations; from there, the specially crafted regex can trigger overflow and supply arbitrary code to the server. Because the flaw resides in input handling for user-supplied data, it is likely exploitable in environments where pipeline configuration changes are made by users with commit rights.