Introduction
The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are now actively exploiting a critical GitLab vulnerability, CVE-2026-97229, which was patched in early April. This vulnerability, tracked as CVE-2026-97229, stems from an integer overflow weakness and could let remote attackers run arbitrary code on targeted instances via a maliciously crafted regular expression in a CI/CD configuration, due to insufficient expression validation. GitLab has addressed the security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8. This guide will provide a detailed overview of the vulnerability, its impact, and steps to mitigate risks.
Understanding CVE-2026-97229
CVE-2026-97229 is a critical security flaw that was discovered by a security researcher using the 'joaxcar' handle in the CI/CD Regular Expression Compiler. This flaw, which is now actively exploited, stems from an integer overflow weakness. GitLab has remediated the issue by patching the vulnerability in their Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8. GitLab urged admins to patch their servers immediately. The company has also released threat detections to support customers with self-managed instances after detecting exploitation attempts.
Impact of CVE-2026-97229
CVE-2026-97229 is a critical security flaw that could allow remote attackers to run arbitrary code on targeted instances via a maliciously crafted regular expression in a CI/CD configuration, due to insufficient expression validation. GitLab has addressed the security issue in their Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8. GitLab urged admins to patch their servers immediately. The company has also released threat detections to support customers with self-managed instances after detecting exploitation attempts. CISA has confirmed active exploitation and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog. CISA also ordered federal agencies to secure their servers by Sunday, as mandated by Binding Operational Directive (BOD) 26-04. The vulnerability affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8.
Steps to Mitigate Risks
GitLab has addressed the security issue in their Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8. GitLab urged admins to patch their servers immediately. The company has also released threat detections to support customers with self-managed instances after detecting exploitation attempts. CISA has confirmed active exploitation and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog. CISA also ordered federal agencies to secure their servers by Sunday, as mandated by Binding Operational Directive (BOD) 26-04. The vulnerability affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8. GitLab urges users to update their GitLab instances to the latest versions to mitigate the risk of exploitation. Users should also ensure that their CI/CD pipelines are configured securely to prevent malicious regular expressions from being executed. GitLab has also released threat detections to support customers with self-managed instances after detecting exploitation attempts. CISA has confirmed active exploitation and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog. CISA also ordered federal agencies to secure their servers by Sunday, as mandated by Binding Operational Directive (BOD) 26-04. The vulnerability affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8. GitLab urges users to update their GitLab instances to the latest versions to mitigate the risk of exploitation. Users should also ensure that their CI/CD pipelines are configured securely to prevent malicious regular expressions from being executed. GitLab has also released threat detections to support customers with self-managed instances after detecting exploitation attempts.
Conclusion
The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are now actively exploiting a critical GitLab vulnerability, CVE-2026-97229. GitLab has addressed the security issue in their Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8. GitLab urged admins to patch their servers immediately. The company has also released threat detections to support customers with self-managed instances after detecting exploitation attempts. CISA has confirmed active exploitation and added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) Catalog. CISA also ordered federal agencies to secure their servers by Sunday, as mandated by Binding Operational Directive (BOD) 26-04. The vulnerability affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.4.2, 19.3.5, and 19.2.8. GitLab urges users to update their GitLab instances to the latest versions to mitigate the risk of exploitation. Users should also ensure that their CI/CD pipelines are configured securely to prevent malicious regular expressions from being executed. GitLab has also released threat detections to support customers with self-managed instances after detecting exploitation attempts.
Tags
GitLab, CISA, CVE-2026-97229, security, CI/CD, integer overflow, arbitrary code execution, Binding Operational Directive (BOD) 26-04