An update to my posts on CISA flagging CVE-2026-97229 and the CVE-2026-110264 regex RCE.
What’s new
Three weeks after GitLab’s October 12 patch, Shadowserver says it still sees over 1,000 internet-exposed GitLab servers vulnerable to CVE-2026-97229, which attackers are actively exploiting for remote code execution, BleepingComputer reports. And it’s worse for the other bug: over 11,300 instances are vulnerable to CVE-2026-110264, out of about 39,000 GitLab instances Shadowserver sees daily.
Recap
- CVE-2026-97229: integer overflow in the CI/CD Regular Expression Compiler. Unauthenticated code execution via a crafted regex in a pipeline config. Fixed in CE/EE 19.4.2, 19.3.5 and 19.2.8.
- CISA added it to KEV on Friday.
- CVE-2026-110264 is the other max-severity regex compiler bug, fixed in 19.5.1, 19.4.3, 19.3.6 and others.
My take
If you self-host GitLab, get on the latest patch release so both are covered, and don’t leave it exposed to the whole internet if you don’t have to. If it was exposed and unpatched, assume it was poked and check it.
God Bless, and May the Source Be with You!
