CISA Confirms Active Exploitation of Critical GitLab Flaw
Summary
CISA confirmed active exploitation of GitLab flaw CVE-2026-97229, which could allow remote code execution through a crafted CI/CD regular expression. GitLab released patches and urged administrators to update.
Key points
- CISA confirmed active exploitation of CVE-2026-97229 and added it to the Known Exploited Vulnerabilities Catalog.
- The flaw is an integer overflow in GitLab's CI/CD Regular Expression Compiler; a crafted regular expression could enable remote code execution on vulnerable instances.
- GitLab patched the flaw in Community Edition and Enterprise Edition versions 19.4.2, 19.3.5, and 19.2.8.
- GitLab released threat detections for customers with self-managed instances after detecting exploitation attempts.
- CISA directed federal agencies to secure affected servers by Sunday under BOD 26-04 and urged private-sector security teams to prioritize patching.
- Shadowserver tracks nearly 2,800 internet-exposed GitLab CE instances; the article does not state how many have been secured.
Article Details
- Vulnerability Types
- Integer overflow
- Insufficient regular expression validation
- Severity
- Critical (maximum severity)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available