Attackers are exploiting a maximum-severity GitLab vulnerability, and more than 1,000 internet-exposed servers remain unpatched, according to BleepingComputer. CISA has confirmed the exploitation and added the flaw, CVE-2026-97229, to its Known Exploited Vulnerabilities catalog.
The bug is an integer overflow in the regular expression compiler that GitLab uses for CI/CD. Under certain conditions an unauthenticated user can run arbitrary code on a GitLab server by supplying a specially crafted regular expression in a CI/CD configuration. The Shadowserver Foundation tracks more than 1,000 exposed, unpatched servers that are vulnerable to it.
GitLab released fixes on October 12 in Community Edition and Enterprise Edition versions 19.4.2, 19.3.5 and 19.2.8. GitLab.com is already patched, and GitLab Dedicated customers need to take no action. Federal civilian agencies were ordered to secure their servers by Sunday, November 8.
The same report notes a separate maximum-severity bug in the same compiler, CVE-2026-110264, disclosed the previous month, and says Shadowserver counts more than 11,300 instances still vulnerable to it. Self-managed GitLab owners should confirm which release they run, update to a fixed version and check CI/CD configurations and server logs for unexpected activity on exposed instances.