CISA says GitLab integer overflow CVE-2026-97229 is exploited
Original title: CISA Warns of GitLab Integer Overflow Vulnerability Exploited in Attacks
Fixes cover GitLab 19.2.8, 19.3.4, and 19.4.2; federal agencies face a November 1 deadline.
CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29 after confirming active exploitation. An integer overflow in regular-expression handling of CI/CD configurations can let an unauthenticated attacker execute code on GitLab Community Edition and Enterprise Edition. GitLab scored the flaw 10.0, and fixes for the 19.2, 19.3, and 19.4 branches shipped on October 12. CISA does not name attackers, victims, or scale, and lists ransomware use as unknown.
Unconfirmed: CISA has not identified attackers, victims, or exploitation scale, and ransomware use is listed as unknown.
- Affected ranges are 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2.
- BOD 26-04 sets a November 1, 2026 deadline and requires forensic triage where applicable.
- The catalog entry marks ransomware use as unknown.
- A later flaw, CVE-2026-110264, is not fixed by the CVE-2026-97229 update.
Impact: Unauthenticated arbitrary code execution on the GitLab server
| Product | Affected | Fixed in |
|---|---|---|
| GitLab Community Edition and Enterprise Edition | 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2 | 19.2.8, 19.3.4, and 19.4.2 |
- 1.Upgrade affected 19.2, 19.3, and 19.4 releases to 19.2.8, 19.3.4, or 19.4.2.
- 2.Federal civilian agencies must remediate by November 1 and check for prior compromise.
- 3.Treat CVE-2026-110264 separately; the earlier GitLab update does not fix it.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110264 | Unauthenticated RCE in GitLab CE/EE via regex integer overflow | 10.0 | 1% | PoC ×8 | |
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 | 18% | KEVPoC ×5 | KEV |
From the original article
2 min read at cybersecuritynews.com
The Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting CVE-2026-97229. This GitLab vulnerability could allow code execution without logging in. CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 29, 2026, confirming evidence of active exploitation and raising the urgency for organizations running affected GitLab servers.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.