--- title: Over 1,000 GitLab servers vulnerable to ongoing RCE attacks description: Over 1,000 internet-exposed GitLab servers remain unpatched against a maximum-severity remote code execution flaw under active attack. The bug, CVE-2026-97229,... canonical: https://daily.dev/posts/over-1-000-gitlab-servers-vulnerable-to-ongoing-rce-attacks-dsbgbwvkf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Over 1,000 GitLab servers vulnerable to ongoing RCE attacks | daily.dev og:description: Over 1,000 internet-exposed GitLab servers remain unpatched against a maximum-severity remote code execution flaw under active attack. The bug, CVE-2026-97229,... og:url: https://daily.dev/posts/over-1-000-gitlab-servers-vulnerable-to-ongoing-rce-attacks-dsbgbwvkf og:image: https://api.daily.dev/og/posts/DsBGBWVkF.png og:image:alt: Over 1,000 GitLab servers vulnerable to ongoing RCE attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Over 1,000 GitLab servers vulnerable to ongoing RCE attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 2 upvotes · 0 comments ## Summary Over 1,000 internet-exposed GitLab servers remain unpatched against a maximum-severity remote code execution flaw under active attack. The bug, CVE-2026-97229, is an integer overflow in the CI/CD Regular Expression Compiler that could allow an unauthenticated user to run arbitrary code via a specially crafted regex in a CI/CD configuration. GitLab patched it three weeks ago in versions 19.4.2, 19.3.5, and 19.2.8. CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to secure their servers by Sunday. Shadowserver also counts over 11,300 instances still vulnerable to a separate flaw, CVE-2026-110264, out of roughly 39,000 GitLab instances it sees daily. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-97229 in GitLab and how does it work? CVE-2026-97229 is a maximum-severity integer overflow vulnerability in GitLab's CI/CD Regular Expression Compiler, the component that parses regular expressions in pipeline configuration files. Under certain conditions it lets an unauthenticated attacker execute arbitrary code on the GitLab server using a specially crafted regular expression placed in a CI/CD configuration, due to insufficient regex validation. _Teams running self-managed GitLab can track exploited CVEs like this one on daily.dev before they hit production._ ### Which GitLab versions fix CVE-2026-97229? GitLab fixed the flaw in Community Edition and Enterprise Edition versions 19.4.2, 19.3.5, and 19.2.8, released on October 12. GitLab.com was already running the patched version at release time, and GitLab Dedicated customers did not need to take any action. Self-managed installations were strongly urged to upgrade immediately. _Developers planning a GitLab upgrade can follow patch advisories like this on daily.dev._ ### How many GitLab servers are still vulnerable to actively exploited CVEs? Threat watchdog Shadowserver reported tracking over 1,000 internet-exposed GitLab instances still vulnerable to CVE-2026-97229, despite patches being available for three weeks, and separately found more than 11,300 instances still vulnerable to CVE-2026-110264, out of roughly 39,000 GitLab instances it scans daily. _Security teams gauging real-world patch gaps can follow exploitation data like this on daily.dev._ ## Similar posts on daily.dev - [Alpine Linux rebuilds GitLab after attempted RCE attack](https://daily.dev/posts/alpine-linux-rebuilds-gitlab-after-attempted-rce-attack-md9lg8poo) · BleepingComputer · 0 upvotes · 0 comments - [GitLab Vulnerability Under Active Exploitation Enables Unauthenticated Data Exfiltration](https://daily.dev/posts/gitlab-vulnerability-under-active-exploitation-enables-unauthenticated-data-exfiltration-5hnex7c8x) · InfoQ · 0 upvotes · 0 comments - [Critical GitHub RCE bug exposed millions of repositories](https://daily.dev/posts/critical-github-rce-bug-exposed-millions-of-repositories-qqjftnlqc) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cicd](https://daily.dev/tags/cicd), [#gitlab](https://daily.dev/tags/gitlab) [View this post on daily.dev](https://daily.dev/posts/over-1-000-gitlab-servers-vulnerable-to-ongoing-rce-attacks-dsbgbwvkf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Over 1,000 GitLab servers vulnerable to ongoing RCE attacks","url":"https://daily.dev/posts/over-1-000-gitlab-servers-vulnerable-to-ongoing-rce-attacks-dsbgbwvkf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/over-1-000-gitlab-servers-vulnerable-to-ongoing-rce-attacks-dsbgbwvkf"},"datePublished":"2026-11-02T12:47:21.853Z","dateModified":"2026-11-02T12:47:52.287Z","description":"Over 1,000 internet-exposed GitLab servers remain unpatched against a maximum-severity remote code execution flaw under active attack. The bug, CVE-2026-97229,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/22f2dfa6eaf88f22a7291075cae720f1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/22f2dfa6eaf88f22a7291075cae720f1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/over-1-000-gitlab-servers-vulnerable-to-ongoing-rce-attacks-dsbgbwvkf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cicd,gitlab","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Over 1,000 GitLab servers vulnerable to ongoing RCE attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/over-1-000-gitlab-servers-vulnerable-to-ongoing-rce-attacks-dsbgbwvkf#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-97229 in GitLab and how does it work?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-97229 is a maximum-severity integer overflow vulnerability in GitLab's CI/CD Regular Expression Compiler, the component that parses regular expressions in pipeline configuration files. Under certain conditions it lets an unauthenticated attacker execute arbitrary code on the GitLab server using a specially crafted regular expression placed in a CI/CD configuration, due to insufficient regex validation. Teams running self-managed GitLab can track exploited CVEs like this one on daily.dev before they hit production."}},{"@type":"Question","name":"Which GitLab versions fix CVE-2026-97229?","acceptedAnswer":{"@type":"Answer","text":"GitLab fixed the flaw in Community Edition and Enterprise Edition versions 19.4.2, 19.3.5, and 19.2.8, released on October 12. GitLab.com was already running the patched version at release time, and GitLab Dedicated customers did not need to take any action. Self-managed installations were strongly urged to upgrade immediately. Developers planning a GitLab upgrade can follow patch advisories like this on daily.dev."}},{"@type":"Question","name":"How many GitLab servers are still vulnerable to actively exploited CVEs?","acceptedAnswer":{"@type":"Answer","text":"Threat watchdog Shadowserver reported tracking over 1,000 internet-exposed GitLab instances still vulnerable to CVE-2026-97229, despite patches being available for three weeks, and separately found more than 11,300 instances still vulnerable to CVE-2026-110264, out of roughly 39,000 GitLab instances it scans daily. Security teams gauging real-world patch gaps can follow exploitation data like this on daily.dev."}}]} ```