The catalogue says GitLab. The bug is in Ruby's regular expression engine, and Ruby has not issued a CVE for it
2026-10-30Security
CVE-2026-97229 is a 10.0 that CISA listed on 29 October, due 1 November. GitLab patched it on the 12th. The underlying Onigmo overflow produced four GitLab CVEs and no Ruby ones, so GitLab's numbers are the only ones a scanner can match.