More than 1,000 internet-exposed GitLab servers remain vulnerable to CVE-2026-97229, a maximum-severity flaw now being exploited in the wild, according to threat monitoring group Shadowserver.
The vulnerability is caused by an integer overflow in GitLab's CI/CD Regular Expression Compiler, which processes regular expressions in pipeline configuration files. Under certain conditions, an unauthenticated attacker could use a specially crafted expression to execute arbitrary code on a GitLab server because of insufficient validation.
GitLab disclosed the issue on October 12 and released fixes for Community Edition and Enterprise Edition versions 19.4.2, 19.3.5 and 19.2.8. The company urged operators of self-managed installations to upgrade immediately. GitLab.com was already running a patched version, while GitLab Dedicated customers were told that no action was required.
The US Cybersecurity and Infrastructure Security Agency confirmed on Friday that the flaw was being exploited and added it to its Known Exploited Vulnerabilities catalog. Federal agencies were instructed to secure affected systems by Sunday.
Despite the availability of patches, Shadowserver said on Sunday that it was tracking more than 1,000 vulnerable GitLab instances exposed to ongoing attacks. The group also reported more than 11,300 instances vulnerable to another Regular Expression Compiler flaw, CVE-2026-110264, among roughly 39,000 GitLab instances it observes daily.
CVE-2026-97229 is part of a series of GitLab vulnerabilities addressed this year. Since January, the company has fixed issues including CVE-2026-0723, which could allow credentials and other secrets to be stolen, and CVE-2026-110264, which can enable arbitrary code execution. CISA has added six GitLab vulnerabilities to its actively exploited flaws catalog since November 2021; one of them has also been linked to ransomware attacks.
Sources: BleepingComputer.