Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

CISA flags exploited GitLab regex flaw after Alpine probe

8 sources · 8 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA added max-severity GitLab CVE-2026-97229 to KEV after Alpine saw attack attempts and found no proof of code execution.

CISA added CVE-2026-97229, a CVSS 10 integer overflow in GitLab Community and Enterprise Edition regex handling, to the Known Exploited Vulnerabilities catalog on October 29 and set a November 1, 2026 federal deadline under BOD 26-04. An unauthenticated user can run code through a crafted regular expression in CI/CD configuration; the bug is in Ruby’s Onigmo engine. Alpine Linux says an attacker probed gitlab.alpinelinux.org on October 20–21 while it ran GitLab 19.3.4, crashing workers eight times with four getting partway through the exploit. Alpine found no evidence of code execution or package tampering but rebuilt the instance and reset passwords because logs are missing. Official GitLab packages patch bundled Ruby; stock-Ruby installs stay exposed until Ruby 3.3.13, 3.4.12, or 4.0.9 or later. Fixed GitLab versions conflict: BleepingComputer and GBHackers cite 19.4.2, 19.3.5, and 19.2.8, while Cyber Security News cites 19.3.4.

Key facts
  • CVE-2026-97229 is CVSS 10.0; GitLab fixes shipped October 12.
  • Alpine was on 19.3.4; an October 22 move to 19.3.6 missed the Ruby patch.
  • Ruby fixes are 3.3.13, 3.4.12, and 4.0.9, released October 23.
  • Federal agencies must remediate by November 1, 2026; ransomware use is unknown.
  • Researcher joaxcar is credited; Rapid7 published a lab proof of concept October 13.
  • Shadowserver tracks nearly 2,800 internet-exposed GitLab CE instances.
Analyze CVE-2026-97229 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 12, 2026GitLab ships fixes for CVE-2026-97229. · SecurityWeek
  2. Oct 13, 2026Rapid7 publishes a lab proof of concept. · The Hacker News
  3. Oct 20, 2026Attacker probes Alpine GitLab; crashes continue October 21. · Lobsters
  4. Oct 23, 2026Ruby releases Onigmo fixes; Alpine blocks the account. · The Hacker News
  5. Oct 29, 2026CISA adds CVE-2026-97229 to the KEV catalog. · CISA Known Exploited Vulnerabilities

What each outlet adds

beyond the shared facts
  • LobstersEight crashes, four partial exploits, and the October 27 Ruby image.
  • The Hacker NewsOctober 13 upgrade mistake and Rapid7 lab proof of concept.
  • Cyber Security NewsLists 19.3.4 as a fix, unlike other outlets.
  • GBHackersCredits joaxcar and states the CVSS vector.
  • BleepingComputerShadowserver exposure count and GitLab user figures.
CVEs
CVE-2026-97229CVE-2026-110264
Vendors
GitLab
Products
GitLab Community EditionGitLab Enterprise EditionRubyalpinelinux/gitlab
Victims
Alpine Linux
Organizations
CISAShadowserverRapid7HackerOne
Countries
United States

Coverage

oldest first · one row per article · UTC
  1. · 3d ago DataBreaches.netFirst report

    GitLab patches max-severity regex compiler RCE (CVE-2026-110264)

    Unauthenticated users can run code via integer overflow when a crafted regular expression is compiled.

  2. · 2d ago Lobsters · security

    Alpine rebuilds GitLab after CVE-2026-97229 exploit attempts

    Alpine found no proof of code execution or package tampering, but reset every password and replaced GitLab secret keys.

  3. · 2d ago CISA Known Exploited Vulnerabilities

    CISA KEV lists GitLab unauthenticated RCE CVE-2026-97229

    A crafted regular expression in CI/CD configuration can run arbitrary code; the federal due date is November 1, 2026.

  4. · 1d ago The Hacker News

    Attacker probed Alpine GitLab via CVSS 10 flaw (CVE-2026-97229)

    Alpine rebuilt gitlab.alpinelinux.org and reset passwords after probes; GitLab upgrades alone miss installs on stock Ruby.

  5. · 15h ago Cyber Security News

    CISA says GitLab integer overflow CVE-2026-97229 is exploited

    Fixes cover GitLab 19.2.8, 19.3.4, and 19.4.2; federal agencies face a November 1 deadline.

  6. · 14h ago SecurityWeek

    Max-severity GitLab flaw exploited against Alpine Linux

    CVE-2026-97229 allows unauthenticated code execution; Alpine rebuilt its instance, and CISA gave agencies three days to patch.

  7. · 11h ago GBHackers

    CISA confirms active exploitation of GitLab CVE-2026-97229

    Unauthenticated attackers can run code via a crafted CI/CD regex; federal remediation is due November 1.

  8. · 11h ago BleepingComputer

    Attackers exploit max-severity GitLab flaw CVE-2026-97229

    The integer overflow allows unauthenticated code execution through a crafted CI/CD regular expression; fixes are 19.4.2, 19.3.5, and 19.2.8.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-110264
Unauthenticated RCE in GitLab CE/EE via regex integer overflow
10.01%PoC ×8
CVE-2026-97229
Unauthenticated RCE in GitLab CE/EE via CI/CD regex
10.018%KEVPoC ×5
KEV