Shadowserver Foundation reported on November 1 that it was tracking more than 1,000 internet-exposed GitLab instances still vulnerable to CVE-2026-97229, a critical flaw used in remote code execution attacks. The organization also counted more than 11,300 instances vulnerable to a separate GitLab flaw, CVE-2026-110264, among roughly 39,000 GitLab instances it sees daily.
CVE-2026-97229 is an integer overflow in GitLab’s CI/CD regular-expression compiler. Under certain conditions, an unauthenticated attacker can execute code on a server by submitting a specially crafted regular expression in a CI/CD configuration. GitLab fixed the vulnerability in versions 19.4.2, 19.3.5 and 19.2.8 on October 12. CISA added it to its Known Exploited Vulnerabilities catalog on October 29.
The latest exposure count follows earlier attempted exploitation against Alpine Linux’s self-hosted GitLab instance, where crafted requests crashed worker processes but the project found no evidence of successful code execution. GitLab’s October security release says GitLab.com was already patched and GitLab Dedicated tenants received an internal fixed release.
Shadowserver’s same-day telemetry also found more than 11,300 instances vulnerable to CVE-2026-110264, another critical regular-expression compiler flaw that GitLab patched on October 21.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
