A critical GitLab flaw that was patched earlier this month is now being exploited in real attacks, which matters most to anyone running their own GitLab server.
The US Cybersecurity and Infrastructure Security Agency (CISA) added the bug, tracked as CVE-2026-97229, to its Known Exploited Vulnerabilities catalog on October 29. CISA's alert describes it as a "GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound vulnerability." CISA says it adds vulnerabilities to the catalog based on evidence of active exploitation, so the entry is effectively confirmation that attackers are already using it.
What the flaw does
According to BleepingComputer, the problem sits in GitLab's CI/CD Regular Expression Compiler, the component that parses, compiles and evaluates regular expressions in pipeline configuration files. BleepingComputer attributes it to insufficient validation of those expressions, leading to an integer overflow, and reports that a remote, unauthenticated attacker could use a specially crafted regular expression in a CI/CD configuration to run arbitrary code on the GitLab server. GitLab, as quoted by the outlet, says this can happen "under certain conditions."
BleepingComputer describes the bug as maximum-severity and says it was reported by a researcher using the handle "joaxcar". The outlet also reports that GitLab has detected exploitation attempts and has released threat detections for self-managed customers, though it gives no detail on who is behind the attacks or what they have been used for.
The fix is already out. BleepingComputer says GitLab patched the flaw earlier in October in versions 19.4.2, 19.3.5 and 19.2.8 of both the Community and Enterprise editions. GitLab's patch release notes list the full set of fixes for administrators.
How many servers are exposed
BleepingComputer cites Shadowserver data tracking nearly 2,800 internet-exposed GitLab Community Edition instances, but says there is no figure for how many of those have already been updated. That number only covers Community Edition servers visible from the open internet, so it is a rough floor rather than a full count.
This is also not GitLab's first exploited flaw. BleepingComputer says CISA has tagged six GitLab vulnerabilities as exploited since November 2021, and lists several other serious GitLab bugs from this year, including an earlier maximum-severity flaw in the same Regex Compiler disclosed this month and a maximum-severity flaw in the repository commits API that can expose credentials and other secrets.
What CISA is asking for
CISA's alert points to Binding Operational Directive 26-04, which asks US federal civilian agencies to rapidly fix high-risk catalogued vulnerabilities on publicly exposed systems that would give an attacker full control, and sets expectations for checking whether a system was compromised before the patch went on. BleepingComputer reports that federal agencies have until this Sunday to secure their servers; the outlet gives only the weekday, not a date.
The directive only binds federal agencies, but BleepingComputer reports that CISA urged private-sector teams to prioritise the patch too. The same alert added a second flaw, CVE-2026-76418, affecting Cisco Secure Firewall ASA and Secure FTD software.
For anyone who runs GitLab for a team, a studio or a side project, the practical steps are simple: check the version, take the fixed release for your line (19.2.8, 19.3.5 or 19.4.2) or move to a newer one, and, given CISA's emphasis on checking for compromise, review whether the server was reachable and unpatched while attacks were under way.
Mason's take: The interesting part is not that GitLab had a bad bug; every big platform does. It is where the bug lives. CI/CD pipelines are the machinery that builds and ships software, which makes the server that runs them one of the most valuable boxes a small company or game studio owns. A flaw that lets an outsider run code there through a pipeline file should move "update GitLab" from the bottom of the to-do list to the top, today.
Reporting notes