More than 1,000 internet-exposed GitLab servers remain unpatched against a vulnerability that attackers are actively exploiting to run code remotely, according to BleepingComputer. The flaw, tracked as CVE-2026-97229, stems from an integer overflow in GitLab’s CI/CD Regular Expression Compiler, which processes regular expressions in pipeline configuration files.
GitLab said on October 12 that the issue could let an unauthenticated user run arbitrary code on a server by submitting a specially crafted regular expression to a CI/CD configuration. It released fixes for Community Edition (CE) and Enterprise Edition (EE) in versions 19.4.2, 19.3.5, and 19.2.8. The company recommended that self-managed installations upgrade to one of those versions. GitLab.com was already patched, and GitLab Dedicated customers did not need to act.
On Friday, the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) Catalog after confirming exploitation in the wild. It ordered federal agencies to secure affected servers by Sunday. Shadowserver said it was tracking more than 1,000 vulnerable instances over the weekend. It also reported more than 11,300 instances vulnerable to CVE-2026-110264 among roughly 39,000 GitLab instances it sees daily.
CISA has added six GitLab vulnerabilities to its exploited-vulnerability catalog since November 2021. GitLab says its platform has more than 70 million registered users and is used by over 50% of Fortune 100 companies.
Comments
0No comments yet. Be the first to comment.