Alpine rebuilds GitLab after CVE-2026-97229 exploit attempts
Original title: GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux
Alpine found no proof of code execution or package tampering, but reset every password and replaced GitLab secret keys.
On October 20 and 21, an attacker tried to exploit CVE-2026-97229, a critical GitLab flaw in CI regular-expression evaluation, on Alpine Linux’s GitLab 19.3.4. Crafted CI configurations crashed worker processes eight times; in four crashes the attacker got partway through the exploit. Alpine found no evidence of code execution or tampering of aports, packages, or the October 21 releases, but missing logs mean success cannot be ruled out, so the instance was rebuilt and all passwords reset. An October 22 upgrade to 19.3.6 did not apply GitLab’s Ruby patch because Alpine’s image used standard Ruby.
Unconfirmed: Alpine cannot confirm or rule out that the attacker achieved code execution.
- CVE-2026-97229 is rated CVSS 10.0; GitLab fixed releases shipped October 12.
- The bug is in Onigmo, Ruby’s regular-expression engine.
- Upstream Ruby fixed it on October 23 in 3.3.13, 3.4.12, and 4.0.9.
- The October 27 alpinelinux/gitlab:19.3.6 image contains Ruby 3.3.13.
- Signing keys were never stored on the GitLab server.
Impact: Possible code execution and exposure of GitLab secrets if it succeeded
| Product | Affected | Fixed in |
|---|---|---|
| GitLab | 19.3.4 on Alpine’s instance; images using standard Ruby | official packages from October 12; Ruby 3.3.13, 3.4.12, or 4.0.9 or later |
| Alpine Linux alpinelinux/gitlab | 19.3.6 images pulled before October 27, and all older tags | alpinelinux/gitlab:19.3.6 republished October 27 |
- 1.If you reused a gitlab.alpinelinux.org password elsewhere, change it there.
- 2.If you use alpinelinux/gitlab, pull the October 27 19.3.6 image again.
- 3.Self-built GitLab also needs Ruby 3.3.13, 3.4.12, 4.0.9, or later.
- CVEs
- CVE-2026-97229
- Vendors
- GitLab
- Products
- Rubyalpinelinux/gitlab
- Victims
- Alpine Linux
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 | 18% | KEVPoC ×5 | KEV |
From the original article
5 min read at alpinelinux.orgOn October 20 and 21, an attacker tried to exploit a GitLab vulnerability (CVE-2026-97229) on our instance, a week after the fix was released. The attack came close to working. We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch.
By alpinelinux.org by durrendal · alpinelinux.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.