Attacker Aims a Perfect-10 GitLab Bug at Alpine Linux’s Servers
An attacker went after Alpine Linux's GitLab with CVE-2026-97229, the CVSS 10 Ruby regex bug, and CISA added it to KEV (due Nov. 1). Alpine found no tampering but rebuilt anyway. Self-built Ruby needs its own upgrade.
Someone tried to break into Alpine Linux’s GitLab server with CVE-2026-97229, the perfect-10 GitLab bug patched on Oct. 12, and CISA has now added it to its list of exploited flaws. SecurityWeek reports the attack began about a week after the fix. Alpine’s own write-up says it failed as far as it can tell, but the project rebuilt the server from scratch anyway.
For defenders
The bug: CVE-2026-97229, CVSS 10.0. An integer overflow in Onigmo, the Ruby regex engine, lets an unauthenticated user run code on a GitLab server through a crafted regular expression in a CI/CD configuration. Affected: GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. It’s one of four Onigmo bugs from the same researcher; we covered the newer CVE-2026-110264 last week, and you need both fixes.
The trap: the flaw lives in Ruby, not GitLab’s own code. If you build GitLab with your own Ruby, from source or a custom image, upgrading GitLab isn’t enough; you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later. That’s what bit Alpine: its Oct. 22 move to GitLab 19.3.6 still left the instance vulnerable.
What happened at Alpine: the attacker registered an account on Oct. 20 and sent crafted CI configs, crashing GitLab workers eight times; in four of those crashes the exploit got partway before failing. They also downloaded Alpine’s GitLab container image, which looks like tuning the exploit for that exact build, and came back on Oct. 25 and 26. Alpine found no sign of code running but can’t rule it out, because background-job logs were lost and outbound connections weren’t logged. It checked commits, packages built Oct. 20 to 24 and the Oct. 21 releases against records outside GitLab and found no tampering; signing keys were never on that server.
Status: KNOWN exploitation attempts. CISA added it to KEV on Oct. 29 with a Nov. 1 deadline for federal agencies. EPSS puts the chance of exploitation in the next 30 days at 18%, and six public proof-of-concept repositories are reported on GitHub. This is T1190 (Exploit Public-Facing Application).
Look for: new accounts submitting unusual CI configs, repeated worker crashes, and pulls of your own GitLab image by unknown users. GitLab’s published “Onigmo native worker crash” rule, linked in our earlier story, fits this attack. Alpine also saw automated logins with passwords leaked elsewhere and reset every account.
What it means for you
Alpine Linux is the small operating system inside a huge number of software containers. The good news: Alpine says its packages and releases weren’t touched, so there’s nothing to reinstall. If you have an account on Alpine’s GitLab, your password was reset and you’ll need to set a new one, and if you used that password anywhere else, change it there too.
Do this now
- Upgrade self-managed GitLab to the current patch release for your branch, which covers this bug and CVE-2026-110264.
- If you build GitLab with your own Ruby, upgrade Ruby to 3.3.13, 3.4.12, 4.0.9 or later as well.
- Using the alpinelinux/gitlab image? Pull it again; Alpine says images pulled before Oct. 27 are vulnerable.
- Turn off open sign-up if you don’t need it, and check for worker crash bursts since Oct. 12.
CVE at a glance
- CVSS
- 10 Critical (v3.1)
- EPSS
- 26.6% chance of exploitation in the next 30 days (higher than 98% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Oct 29, 2026
- Public exploit
- Yes, reported in 6 GitHub repositories
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.