CISA warns of maximum severity GitLab security flaw active exploitation

The Cybersecurity and Infrastructure Security Agency added a maximum severity GitLab remote code execution flaw to its Known Exploited Vulnerabilities catalog on October 30, 2026, according to The Hacker News. CyberSecurityNews and SecurityWeek both reported that the flaw is being actively exploited in attacks, with SecurityWeek noting malicious activity targeted Alpine Linux. [1][2][5][6]

The Hacker News reported that CISA also added a Cisco firewall denial of service vulnerability to its Known Exploited Vulnerabilities catalog alongside the GitLab security flaw. Meanwhile, GBHackers News reported on a critical Linux kernel vulnerability that allows remote attackers to crash Ubuntu systems, and CyberSecurityNews noted a separate Linux kernel missing initialization vulnerability added to CISA warnings. [3][4][5][6]

As FTMQ Security reported earlier, the GitLab flaw is tracked as CVE-2026-97229 with a CVSS score of 10.0. It is a maximum severity integer overflow issue in regular expression handling for GitLab Community Edition and Enterprise Edition. GitLab patched the security flaw on October 12, 2026, in versions 19.4.2, 19.3.5, and 19.2.8. [10]

Alpine Linux is a security focused Linux distribution built using musl, BusyBox, and OpenRC. It compiles user space binaries as position independent executables with stack smashing protection and is widely deployed inside containers, virtual machines, and embedded network devices. [8][9]