More than 11,300 GitLab instances remain vulnerable to CVE-2026-110264, a flaw that allows attackers to execute code remotely. The vulnerability is located in the Regular Expression Compiler. The Shadowserver Foundation reports that 1,000 servers are also missing the patch for CVE-2026-97229, a vulnerability that is already being actively exploited.
The Shadowserver Foundation detects approximately 39,000 GitLab instances on the internet every day. A significant portion of these are vulnerable to known exploits. More than 1,000 servers lack a patch for CVE-2026-97229. More than 11,300 instances are also exposed to CVE-2026-110264. That’s nearly 30 percent of all installations the organization can detect.
It is especially important to patch the first vulnerability immediately. CVE-2026-97229 has been listed in CISA’s Known Exploited Vulnerabilities catalog since October 29. Attackers are therefore already exploiting the vulnerability, with all the consequences that entails. U.S. federal agencies were required to patch the vulnerability by yesterday at the latest.
Regex as an attack vector
Both vulnerabilities have a CVSS score of 10.0 and are located in the Ruby/Onigmo regex engine that GitLab provides. In the case of CVE-2026-97229, an attacker can use a specific regular expression in a CI/CD configuration to execute arbitrary code on a self-managed GitLab CE or EE server. CVE-2026-110264 is located in the Regular Expression Compiler and also allows an unauthenticated attacker to execute code. According to available reports, no exploitation of this second vulnerability has been confirmed yet.
Incidentally, those who applied patches quickly may only be partially protected. Versions 19.4.2, 19.3.5, and 19.2.8 address CVE-2026-97229 but not CVE-2026-110264.
Which versions are secure?
On October 21, GitLab released patches that address both vulnerabilities. These include versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, and 18.11.13. More information about these versions can be found in GitLab’s patch notes. Security researchers also recommend checking CI/CD configurations and logs for suspicious regex patterns. Additionally, administrators should replace tokens, deploy keys, and other secrets on the server. Shadowserver shares the IP addresses of vulnerable instances via its Vulnerable HTTP report.
See also: GitLab patches critical vulnerability allowing code execution