More than 1,000 internet-exposed GitLab servers remain unpatched against CVE-2026-97229, a maximum-severity integer overflow vulnerability in GitLab’s CI/CD regular expression compiler. Attackers are actively exploiting the flaw to conduct remote code execution attacks, according to the US Cybersecurity and Infrastructure Security Agency (CISA) and threat-monitoring organization Shadowserver.
CVE-2026-97229 is classified as an integer overflow weakness. The vulnerability affects the CI/CD regular expression compiler, which parses and evaluates regular expressions in pipeline configuration files.
GitLab releases security updates
On October 12, GitLab released Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5 and 19.2.8 to address the vulnerability and other bugs and security issues.
“These versions contain important bugs and security fixes, and we strongly recommend that all self-managed GitLab installations upgrade to one of these versions immediately. GitLab.com is already running the patched versions. GitLab Dedicated customers do not need to take any action,” GitLab said.
On Friday, CISA confirmed that attackers had begun exploiting CVE-2026-97229 in the wild. The agency added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog and ordered federal agencies to secure affected servers by Sunday.
More than 1,000 vulnerable servers tracked
GitLab released a patch three weeks ago, but Shadowserver said over the weekend that it was tracking more than 1,000 unpatched GitLab servers. The organization said the vulnerable systems were under continuous attack.
“We are currently tracking over 1,000 GitLab instances (on @CISACyber KEV) that are vulnerable to CVE-2026-97229 and over 11,300 instances (out of approximately 39,000 GitLab instances reviewed daily) that are vulnerable to CVE-2026-110264,” Shadowserver said on Sunday.
Recent GitLab vulnerabilities also exploited
CVE-2026-97229 is the latest in a series of GitLab security issues addressed since the beginning of the year. In January, GitLab fixed the high-severity CVE-2026-0723, which could allow attackers to bypass two-factor authentication.
In September, GitLab addressed the maximum-severity CVE-2026-85706, which could allow attackers to make unauthorized commits through the repository API and potentially steal credentials and other secrets. CISA also listed that vulnerability as being exploited in the wild after cybersecurity firm watchTowr reported that attackers had started scanning vulnerable GitLab servers.
Last month, another maximum-severity regular expression compiler flaw, CVE-2026-110264, was reported. The vulnerability allowed attackers to execute arbitrary code on a targeted GitLab instance.
Since November 2021, CISA has added six GitLab vulnerabilities to its catalog of actively exploited flaws. One of those vulnerabilities has also been used in ransomware attacks.
According to GitLab, its DevSecOps platform has more than 70 million registered users and is used by more than 50% of Fortune 100 companies worldwide.
Source: www.bleepingcomputer.com