More than 1,000 internet-facing GitLab servers remain vulnerable to a flaw that attackers are actively exploiting to execute code remotely, BleepingComputer reported on November 2, citing Shadowserver measurements. GitLab released patches on October 12, leaving administrators of unpatched, self-managed installations with an urgent update to apply.
The vulnerability, CVE-2026-97229, affects GitLab Community Edition (CE) and Enterprise Edition (EE). CISA confirmed active exploitation in an October 29 alert announcing its addition to the Known Exploited Vulnerabilities catalog, which tracks flaws used in real attacks.
The exposure count concerns vulnerable servers. Shadowserver said on Sunday that it was tracking more than 1,000 instances vulnerable to CVE-2026-97229.
How the flaw permits code execution
The maximum-severity vulnerability involves an integer overflow, a condition in which a calculation exceeds the range a program can represent. It sits in GitLab’s CI/CD Regular Expression Compiler, which processes text-matching patterns in configuration files for automated build, test and deployment pipelines.
In its October 12 statement, reproduced by BleepingComputer, GitLab said insufficient validation of those patterns could, under certain conditions, allow an unauthenticated user to execute arbitrary code on the server. The attack input is a specially crafted regular expression in a CI/CD configuration.
GitLab identified CE and EE releases 19.4.2, 19.3.5 and 19.2.8 as containing the security fixes. The company strongly recommended that all self-managed installations upgrade immediately. It said GitLab.com was already patched and GitLab Dedicated customers did not need to take action.
A second compiler flaw leaves more instances exposed
Shadowserver also reported more than 11,300 instances vulnerable to CVE-2026-110264 within the roughly 39,000 GitLab instances it observes daily. That separate, maximum-severity Regular Expression Compiler flaw, addressed last month, also permits arbitrary code execution on targeted instances. CISA’s exploitation confirmation for CVE-2026-97229 concerns that specific identifier; the larger exposure figure concerns CVE-2026-110264.
Other GitLab fixes this year included January’s high-severity two-factor authentication bypass, CVE-2026-0723, and September’s maximum-severity repository commits API flaw, CVE-2026-85706, which can expose credentials and other secrets. CISA flagged the latter as actively exploited after watchTowr reported attackers scanning for vulnerable servers.
BleepingComputer reported that CISA has added six GitLab flaws to its exploited-vulnerability catalog since November 2021, including one used in ransomware attacks. GitLab says its platform has more than 70 million registered users and is used by more than half of Fortune 100 companies worldwide.
What administrators should do
BleepingComputer reported a Sunday remediation deadline for federal agencies. CISA’s binding directive applies to US Federal Civilian Executive Branch agencies and prioritizes rapid remediation of cataloged vulnerabilities on publicly exposed assets where exploitation grants total control. It also establishes expectations for checking whether attackers compromised systems before patching. CISA encourages other organizations to prioritize cataloged flaws as well.
Administrators of self-managed GitLab installations should follow GitLab’s recommendation to upgrade immediately to the patched CE or EE releases 19.4.2, 19.3.5 or 19.2.8.
