The Cybersecurity and Infrastructure Security Agency (CISA) has warned that threat actors are actively exploiting CVE-2026-97229, a GitLab vulnerability that can enable unauthenticated code execution on affected servers.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 29, 2026, citing evidence of active exploitation and urging organizations running vulnerable GitLab instances to take immediate action.
The issue impacts both GitLab Community Edition and Enterprise Edition. It stems from an integer overflow or wraparound caused by inadequate validation of regular expressions used in CI/CD configurations. A specially crafted expression supplied in a pipeline configuration can reach GitLab’s regular expression compiler and allow an unauthenticated attacker to execute arbitrary code on the server.
Earlier technical reporting by Cybersecuritynews.com detailed how regular expressions—text patterns used for matching or filtering—can be supplied via CI/CD configuration files and, when processed improperly, affect the GitLab server itself rather than merely causing a pipeline task to fail.
GitLab integer overflow vulnerability exploited
An integer overflow happens when a calculation produces a value outside the range the program can store, which can cause the value to wrap to an unexpectedly small or negative number. According to MITRE’s CWE-190 guidance, such errors can lead to crashes, memory corruption, or unauthorized code execution depending on how the software uses the resulting value.
GitLab assigned the flaw the maximum CVSS score of 10.0. Previous reports identified affected releases as versions 19.2 prior to 19.2.8, 19.3 prior to 19.3.4, and 19.4 prior to 19.4.2; those branches received fixes on October 12. Administrators should check their installed release and follow the vendor’s update instructions.
CISA’s catalog entry sets a remediation deadline of November 1, 2026, and requires forensic triage under Binding Operational Directive (BOD) 26-04. The entry marks ransomware use as unknown—this does not establish a ransomware connection—and CISA’s public notice does not name specific attackers, victims, or the scope of exploitation.
The October 29 CISA alert notes that BOD 26-04 mandates that federal civilian agencies prioritize remediation of high-risk vulnerabilities on externally exposed assets. The directive also requires, where applicable, that agencies check for signs of compromise that may have occurred before patches were applied. CISA recommends other organizations adopt similar risk-based patching practices.
Administrators should not confuse this flaw with CVE-2026-110264, a separate GitLab regular expression vulnerability disclosed later in October. Coverage of that separate issue by Cybersecuritynews.com explains that applying the fixes for CVE-2026-97229 does not remediate the newer vulnerability.
Reviewing both advisories will help teams select updates that address both issues and avoid leaving an alternate code-execution path open on their GitLab servers.
Give your SOC the alert context to stop incidents quickly. Integrate threat intelligence from 16K SOCs.
