Provenance Record

Clear News piece (692 words, within 400-1200). Overview, per-CVE mapping, GitLab-side timeline, affected-use conditions, the CVE-ID question and an explicit unknowns section. Closes the loop left open by the Herald's 12 Oct GitLab article.

Read from disk (gunzip, tag-stripped RAW text): source-0 (Ruby regexp-fixes post, 200, sha in manifest), source-1 (Ruby 3.4.12 announcement), source-3 (GitLab 19.4.1 patch notes), source-4 (GitLab 19.5.1 patch notes). All matched raw text, not summaries; live re-fetch via curl of source-0/3/4 returned identical key passages. source-2 (BleepingComputer) snapshot failed (HTTP 403, file null; curl also 403), so the live URL was used via WebFetch and is explicitly flagged as a fallback: it confirms author Sergiu Gatlan, date October 12, 2026, 'CVE-2026-97229 stems from an integer overflow weakness in GitLab's CI/CD Regular Expression Compiler', unauthenticated arbitrary-code execution wording, fixed in 19.2.8/19.3.4/19.4.2, no CVSS and no mention of Ruby/Onigmo (the article makes no such claims about BC). Verified individually: (1) Title 'Behind Four GitLab CVEs': Ruby's post title and body name all four CVEs (CVE-2026-89078, -93577, -97229, -110264) with a table mapping each to a Ruby bug/change; the 3.4.12 announcement quotes the same four. Supported, not overstated. (2) Ruby table: #13332 double free -> 4.0.0/3.4.12/3.3.13; #19020 integer overflow (93577 + 97229) -> 4.0.8/3.4.12/3.3.13; #16801 repeat ID overflow (110264) -> 4.0.9/3.4.12/3.3.13; all exact. (3) Quote 'We have not requested CVE identifiers in Ruby for these fixes, at least for now.' verbatim, in the Ruby post (project voice, posted by k0kubun); 'Applications that only use regular expressions written by their own developers are not affected.' verbatim; 3.3 security-maintenance exception verbatim in substance; CVE-2022-28738/CVE-2024-27282 references and the documentation/timeout statements match; credit to Johan Carlsson (joaxcar) via GitLab's bug bounty matches (GitLab notes say HackerOne). The 3.4.12 quote 'fixes for bugs in Regexp compilation that GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 rely on' matches (typographic apostrophe in source). (4) GitLab 19.4.1 notes: released September 23, 2026 as 19.4.1/19.3.3/19.2.7; CVE-2026-89078 and CVE-2026-93577 both CVSS 9.9. GitLab 19.5.1 notes: October 21, 2026; CVE-2026-110264 CVSS 10.0 (unauthenticated). All exact. (5) RCE: the article attributes 'remote code execution' to what GitLab found, per Ruby's post ('GitLab found that ... could be turned into remote code execution on GitLab servers'); GitLab's own notes say 'execute arbitrary code on the GitLab server'. Attribution accurate. Release date October 23 matches the Ruby posts. Version relationships: 19.4.1 (Sep 23) < 19.4.2 (Oct 12, per Ruby post and earlier Herald article) < 19.5.1 (Oct 21, with 19.4.3 backport); no contradiction. Cross-link /article/2026-10/12-gitlab-1942-1934-and-1928-fix-cve-2026-97229-a-cvss-100-code-execution-flaw-in-the-cicd-regular-expression-compiler resolves to a published article; its description is accurate (the earlier article states at lines 48 and 60 that the Ruby regexp patch entries in the bug-fix lists were not connected to the CVE). Allowlist: ruby-lang.org, bleepingcomputer.com, docs.gitlab.com all present by exact hostname. Independence: Ruby and GitLab are first-party/primary sources; BleepingComputer is the only independent outlet and supports only the CVE-2026-97229 context. No Analysis requirements apply (News). Scanner: suspicious_patterns null for all sources; no injection text found.

Every CVE id, CVSS score, date, version, change number and quote traces to the raw source text. No fabricated specifics. Omission of 97229's CVSS 10.0 and the 19.4.2 date in the new article is not an error. The loaded-language warning from the script matched 'clearly' in 'does not clearly say', a paraphrase of Ruby's own wording: false positive.

Accurate, well-sourced follow-up; all claims verified against raw source text, no corrections needed. Featured candidacy: 1 - solid supply-chain security follow-up for Ruby and GitLab operators, not broad-audience news