Alpine Linux GitLab Hit by CVE-2026-97229 Exploit Attempt
Original: GitLab Security Incident: Attempted Exploitation of CVE-2026-97229
Why This Matters
Self-hosted GitLab users with custom Ruby builds face the same hidden exposure.
An attacker targeted Alpine Linux's GitLab instance on Oct 20–21, 2026, exploiting CVE-2026-97229 (CVSS 10.0). The attack crashed worker processes 8 times. No code execution confirmed, but Alpine rebuilt the instance from scratch as a precaution.
Alpine Linux disclosed that its GitLab instance was targeted on October 20 and 21 by an attacker who exploited CVE-2026-97229, a CVSS 10.0 vulnerability in how GitLab evaluates regular expressions in CI configuration. The underlying bug lives in Onigmo, the regex engine built into Ruby.
GitLab shipped a fix on October 12, but only in its official packages — which patch Ruby directly. Alpine ran GitLab with its own standard Ruby build, meaning its October 22 upgrade to GitLab 19.3.6 did not apply the fix. The team only discovered this gap on October 26, after the attacker had already returned and made further attempts.
During the main attack, a newly registered account submitted crafted CI configurations. GitLab worker processes crashed 8 times; in 4 of those crashes the attacker advanced partway through the exploit before stalling. The attacker also pulled Alpine's GitLab container image, suggesting active exploit tuning.
Alpine found no evidence that code ran on the server, but treated the instance as compromised regardless and rebuilt it from scratch. The aports repository, packages, and October 21 releases were verified against external records and show no tampering. All passwords and GitLab secret keys have been reset. The corrected container image — alpinelinux/gitlab:19.3.6, published October 27 — includes Ruby 3.3.13. Any image pulled before that date remains vulnerable.