A maximum-severity flaw in GitLab is being actively exploited in the wild, and more than 1,000 internet-exposed servers are still unpatched, weeks after the fix was released. CVE-2026-97229, rated CVSS 10.0, is an integer overflow in GitLab's CI/CD regular expression compiler that lets any unauthenticated attacker execute arbitrary code on a self-managed GitLab server with a single HTTP request.

GitLab released emergency patches on 12 October 2026 — versions 19.4.2, 19.3.5 and 19.2.8 — and urged all self-managed installations to upgrade immediately. On 29 October, the US agency CISA added the flaw to its Known Exploited Vulnerabilities catalogue, based on evidence of active exploitation. The flaw affects GitLab Community and Enterprise Edition versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab.com already runs patched code.

Alpine Linux attack attempt

The Alpine Linux project has published details of an attack attempt against its own GitLab instance. On 20 and 21 October, a newly registered account tried to exploit the flaw on its instance, which was still running unpatched version 19.3.4. GitLab worker processes crashed eight times. Alpine found no evidence that the attack succeeded, but could not rule it out, so it treated the instance as compromised and rebuilt it from scratch. Rapid7 has published a working proof of concept and confirmed code execution against the official GitLab CE 19.4.1 image; the same input did not work against patched 19.4.2.

Administrators should upgrade to the latest patch release of their supported branch — the most recent are 19.5.3, 19.4.5, 19.3.7 and 19.2.10 — and note that the first fixes do not cover a second, related CVSS 10.0 regex-compiler flaw, CVE-2026-110264, patched on 21 October. Siemens has also published fixes for flaws flagged in the same 4 November advisories; in both cases the risk now sits with unpatched instances.

Sources: SOCRadar, 5 November 2026; Rapid7, CVE-2026-97229: Critical unauthenticated remote code execution in GitLab, 30 October 2026; CISA Known Exploited Vulnerabilities catalogue, 29 October 2026; BleepingComputer via Kira AI, 3 November 2026.