cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Over 1,000 GitLab Servers Remain Exposed to Exploited RCE Flaw

· Original article ↗

Summary

More than 1,000 internet-exposed GitLab servers remain unpatched against CVE-2026-97229, an actively exploited flaw that can enable unauthenticated remote code execution. GitLab released patches, and CISA added the flaw to its KEV Catalog.

Key points

  • CVE-2026-97229 is an integer overflow flaw in GitLab’s CI/CD Regular Expression Compiler.
  • A specially crafted regular expression in a CI/CD configuration could allow an unauthenticated user to execute code on a server, according to GitLab.
  • GitLab released fixes in CE and EE versions 19.4.2, 19.3.5, and 19.2.8.
  • CISA confirmed exploitation in the wild, added the flaw to its Known Exploited Vulnerabilities Catalog, and directed federal agencies to secure servers by Sunday.
  • Shadowserver reported tracking more than 1,000 exposed GitLab instances vulnerable to the flaw.

Article Details

Vulnerability Types
  • Integer overflow
  • Insufficient regular expression validation
Severity
Maximum severity
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAttackers are actively exploiting CVE-2026-97229 against Internet-exposed GitLab servers to execute code remotely.

CVE

CVE-2026-97229Tracked as CVE-2026-97229, this vulnerability stems from an integer overflow weakness and was discovered in the CI/CD Regular Expression Compiler, which parses and evaluates regular expressions in pipeline configuration

Vendors

GitLabOver 1,000 GitLab servers vulnerable to ongoing RCE attacks

Products

GitLab Community Edition (CE)explained on October 12 when it released security patches to address the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8.

Related Articles