Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

CISA lists max-severity GitLab bug after Alpine attack

7 sources · 7 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CISA set a November 1 deadline for GitLab CVE-2026-97229 after Alpine rebuilt its server following exploit attempts it could not fully rule out.

CISA added CVE-2026-97229 to the Known Exploited Vulnerabilities catalog on October 29. The CVSS 10.0 Onigmo integer overflow in GitLab Community and Enterprise Edition can let an unauthenticated user run code via a crafted CI/CD regular expression. Alpine said October 20–21 probes of gitlab.alpinelinux.org on 19.3.4 crashed workers eight times, four partway through the exploit, with no proof of code execution or package tampering; missing logs led it to rebuild the server and reset passwords. Vendor GitLab packages patch bundled Ruby, but Alpine’s stock Ruby stayed exposed until 3.3.13, 3.4.12, or 4.0.9. Cyber Security News names 19.3.4 as fixed; GBHackers and BleepingComputer say 19.3.5. Federal remediation is due November 1, 2026.

Key facts
  • Alpine reported eight worker crashes on October 20–21 and four partial exploit attempts.
  • Ruby fixes are 3.3.13, 3.4.12, and 4.0.9, released October 23.
  • Outlets agree on GitLab fixes 19.2.8 and 19.4.2; they split on 19.3.4 versus 19.3.5.
  • CISA’s BOD 26-04 deadline is November 1, 2026; ransomware use is unknown.
  • Shadowserver tracks nearly 2,800 internet-exposed GitLab Community Edition instances.
  • Alpine says package-signing keys were never stored on the GitLab server.
Analyze CVE-2026-97229 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 12, 2026GitLab shipped fixes for CVE-2026-97229. · Lobsters
  2. Oct 13, 2026Rapid7 published a lab proof of concept. · The Hacker News
  3. Oct 20, 2026Attacker probed Alpine’s GitLab; attempts continued October 21. · Lobsters
  4. Oct 23, 2026Ruby released fixes; Alpine blocked the account. · The Hacker News
  5. Oct 27, 2026Alpine’s GitLab 19.3.6 image includes Ruby 3.3.13. · Lobsters
  6. Oct 29, 2026CISA added CVE-2026-97229 to the KEV catalog. · CISA Known Exploited Vulnerabilities

What each outlet adds

beyond the shared facts
  • LobstersNo aports tampering found; October 22 GitLab upgrade missed Ruby.
  • The Hacker NewsAccount blocked October 23; users must pull the 19.3.6 image again.
  • BleepingComputerNearly 2,800 exposed Community Edition instances; researcher joaxcar.
  • GBHackersLists 19.3.5, not 19.3.4, as the 19.3 fix.
  • SecurityWeekAlpine is still testing the rebuilt GitLab instance.
CVEs
CVE-2026-97229CVE-2026-110264
Vendors
GitLab
Products
GitLab Community EditionGitLab Enterprise EditionRubyalpinelinux/gitlab
Victims
Alpine Linux
Organizations
CISAShadowserverRapid7
Countries
United States

Coverage

oldest first · one row per article · UTC
  1. · 2d ago Lobsters · securityFirst report

    Alpine rebuilds GitLab after CVE-2026-97229 exploit attempts

    Alpine found no proof of code execution or package tampering, but reset every password and replaced GitLab secret keys.

  2. · 2d ago CISA Known Exploited Vulnerabilities

    CISA KEV lists GitLab unauthenticated RCE CVE-2026-97229

    A crafted regular expression in CI/CD configuration can run arbitrary code; the federal due date is November 1, 2026.

  3. · 1d ago The Hacker News

    Attacker probed Alpine GitLab via CVSS 10 flaw (CVE-2026-97229)

    Alpine rebuilt gitlab.alpinelinux.org and reset passwords after probes; GitLab upgrades alone miss installs on stock Ruby.

  4. · 23h ago Cyber Security News

    CISA says GitLab integer overflow CVE-2026-97229 is exploited

    Fixes cover GitLab 19.2.8, 19.3.4, and 19.4.2; federal agencies face a November 1 deadline.

  5. · 22h ago SecurityWeek

    Max-severity GitLab flaw exploited against Alpine Linux

    CVE-2026-97229 allows unauthenticated code execution; Alpine rebuilt its instance, and CISA gave agencies three days to patch.

  6. · 19h ago GBHackers

    CISA confirms active exploitation of GitLab CVE-2026-97229

    Unauthenticated attackers can run code via a crafted CI/CD regex; federal remediation is due November 1.

  7. · 19h ago BleepingComputer

    Attackers exploit max-severity GitLab flaw CVE-2026-97229

    The integer overflow allows unauthenticated code execution through a crafted CI/CD regular expression; fixes are 19.4.2, 19.3.5, and 19.2.8.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-110264
Unauthenticated RCE in GitLab CE/EE via regex integer overflow
10.01%PoC ×8
CVE-2026-97229
Unauthenticated RCE in GitLab CE/EE via CI/CD regex
10.018%KEVPoC ×5
KEV