CISA says max severity GitLab flaw now exploited in the wild

A critical vulnerability in GitLab, tracked as CVE-2026-97229, is being actively exploited in the wild. The flaw exists in the CI/CD Regular Expression Compiler and stems from an integer overflow weakness, allowing unauthenticated attackers to execute arbitrary code on vulnerable GitLab servers via a specially crafted regular expression in a CI/CD configuration. The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch by a specific deadline, while also urging private sector organizations to prioritize remediation. GitLab has released patches in versions 19.4.2, 19.3.5, and 19.2.8 for both Community and Enterprise Editions.

AI-extracted · verify before operational use