CISA says max severity GitLab flaw now exploited in the wild

What it is

CVE-2026-97229 is a maximum-severity integer overflow in GitLab's CI/CD Regular Expression Compiler, which parses and evaluates regular expressions in pipeline configuration files. A security researcher using the handle joaxcar found it. CISA confirmed active exploitation and added it to the KEV Catalog. The page gives no date for the KEV addition beyond "Thursday", and no detail on the exploitation itself.

Preconditions / Affected

GitLab CE and EE are affected. The fixed releases are 19.4.2, 19.3.5 and 19.2.8, so any instance on an older build in those lines is exposed. Exploitation needs only a crafted regular expression in a CI/CD configuration, and GitLab's advisory says the attacker can be unauthenticated. GitLab describes the trigger as "under certain conditions" and does not say what they are.

What to do

• Upgrade self-managed instances to 19.4.2, 19.3.5 or 19.2.8, or later. GitLab urged admins to patch immediately.
• GitLab has released threat detections for self-managed customers after seeing exploitation attempts. The page does not say where to find them.
• CISA's BOD 26-04 deadline for federal agencies was the Sunday after the KEV listing. CISA encouraged private-sector teams to prioritise the patch as well.

Related GitLab flaws in the same period

The page lists other recent GitLab issues that matter when planning the upgrade:

• CVE-2026-110264: another maximum-severity Regular Expression Compiler flaw, fixed earlier in October 2026, that also allows remote code execution.
• CVE-2026-85706: a maximum-severity flaw in the repository commits API that can leak credentials and other secrets. CISA listed it as exploited one day after the fix, after watchTowr reported internet scanning for unpatched servers.
• CVE-2026-0723: a high-severity two-factor authentication bypass patched in January 2026, which works for attackers who know the target's account ID.

The page does not say which releases fix these, so check each against your version.

Caveats

Shadowserver tracks nearly 2,800 internet-exposed CE instances, but it does not say how many are already patched. CISA has listed six GitLab flaws as exploited since November 2021.