More than 1,000 publicly accessible GitLab servers remain unpatched against a critical vulnerability that attackers are actively exploiting. The flaw, identified as CVE-2026-97229, stems from an integer overflow weakness in the CI/CD Regular Expression Compiler used to process pipeline configuration files. The vulnerability allows unauthenticated users to execute arbitrary code on affected servers through specially crafted regular expressions. GitLab released security patches in mid-October for versions 19.4.2, 19.3.5, and 19.2.8, and the U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its list of actively exploited flaws, ordering federal agencies to patch their systems.
Despite patches being available for three weeks, security researchers at Shadowserver identified over 1,000 vulnerable GitLab instances still exposed online to ongoing attacks. This represents the latest in a series of serious security issues affecting GitLab this year, including other maximum-severity vulnerabilities exploited in the wild. The vulnerability disclosure comes as GitLab’s platform serves over 70 million registered users globally, including more than half of Fortune 100 companies.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
