GitLab introduced an integer overflow or wraparound flaw in the parsing of regular expressions used within CI/CD configuration files. The vulnerability arises when complex patterns are processed, causing an internal counter to overflow. An attacker who can supply a maliciously crafted configuration file can trigger this flaw, leading to arbitrary code execution on the GitLab server. This affects confidentiality, integrity, and availability of the instance.

All GitLab Community Edition and Enterprise Edition releases prior to 19.2.8, 19.3.5, or 19.4.2 are affected. The issue resides in the core CI/CD pipeline component that parses configuration files. Versions stripped of the patch are vulnerable; the CVE notes that unauthenticated users can trigger the flaw via a specially crafted CI/CD configuration.

The CVSS base score of 10 indicates maximum severity. An EPSS score of 27% indicates a higher likelihood of exploitation, and the vulnerability is listed in the CISA KEV catalog. Exploitation requires only that an attacker supply a specially crafted CI/CD configuration file. The CVE specifies that an unauthenticated user can trigger the vulnerability, indicating remote exploitation via the GitLab web interface or API. It is not explicitly stated whether the attacker must have permissions to edit or create pipelines; this is an inference.