More than 1,000 GitLab servers remain exposed to exploited code-execution flaw
More than 1,000 internet-exposed GitLab servers remain vulnerable to CVE-2026-97229, a maximum-severity flaw that attackers are actively exploiting to run code remotely, BleepingComputer reported on November 2. Shadowserver said it was still tracking more than 1,000 exposed and unpatched instances during ongoing attacks.
The vulnerability affects GitLab Community Edition and Enterprise Edition. BleepingComputer said it stems from an integer overflow in GitLab’s CI/CD Regular Expression Compiler, which parses regular expressions in pipeline configuration files.
A specially crafted regular expression can exploit insufficient validation and allow an unauthenticated user to execute arbitrary code on a GitLab server, GitLab said when it announced the patches. The attack therefore does not require an attacker to log in before reaching the vulnerable processing path.
GitLab released fixes on October 12 in versions 19.4.2, 19.3.5 and 19.2.8. The company recommended that all self-managed installations upgrade to one of those versions immediately, according to its advisory as quoted by BleepingComputer.
GitLab.com is already running a patched version, GitLab said. GitLab Dedicated customers do not need to take action, according to the same company statement.
The US Cybersecurity and Infrastructure Security Agency confirmed that exploitation had begun in the wild and added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog, BleepingComputer reported. CISA ordered federal agencies to secure affected servers by Sunday.
Shadowserver also reported more than 11,300 instances vulnerable to another GitLab Regular Expression Compiler flaw, CVE-2026-110264. That figure concerns the separate vulnerability and does not change the more than 1,000-instance count reported for CVE-2026-97229.