The GitLab bug we flagged is now on CISA’s exploited list, and Alpine Linux’s upgrade did not fix it

We flagged this GitLab bug on October 13, and GitLab shipped a second 10.0 fix a week later. This week the first one got worse. CISA put CVE-2026-97229 on its exploited list on Thursday, and Alpine Linux explained how an attacker came close to running code on its GitLab server.

The detail that matters for your own server: Alpine upgraded GitLab and was still vulnerable. The fix lives in the Ruby that GitLab bundles, and a server on its own Ruby does not get it from a GitLab update.

Alpine upgraded GitLab and was still open. The fix is in the Ruby underneath, so check which Ruby your server actually runs.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

CISA lists the GitLab bug we flagged, and Alpine Linux almost lost its server to it

CISA added CVE-2026-97229 to the Known Exploited Vulnerabilities catalog on October 29 with a due date of November 1, and it lists forensic triage as required. GitLab rates the integer overflow in its CI/CD regular expression handling 10.0. It fixed the flaw on October 12 in 19.4.2, 19.3.5 and 19.2.8.

On October 28 the Alpine Linux project published its incident report. A newly registered account sent crafted CI configurations to gitlab.alpinelinux.org on October 20 and 21, crashing GitLab worker processes eight times. In four of those crashes the attacker got partway through the exploit and failed at the next step. Alpine found no evidence that code ran, but it cannot rule it out, so it rebuilt the server from scratch, reset every password and replaced GitLab’s secret keys.

Alpine had installed 19.3.4 on October 13 instead of 19.3.5, which it calls a mistake. When it moved to 19.3.6 on October 22, the server stayed vulnerable, because its container image used a standard Ruby. Alpine says it found no tampering with its packages or the October 21 releases, and its signing keys were never on that server.

Self-built GitLab installs that run their own Ruby

GitLab’s fix is a set of patches to the Ruby that ships inside GitLab’s own Linux packages and container images. The bug is in Onigmo, the regular expression engine inside Ruby. Ruby published its own fixed versions on October 23: 3.3.13, 3.4.12 and 4.0.9. Ruby 3.2 gets no fix.

So the exposure depends on how you installed GitLab. Official packages and official images carry the patched Ruby once you upgrade. Source installs and homemade container images need the Ruby update as well. The Hacker News reports that as of October 29 neither GitLab patch post told administrators of self-compiled installs to update Ruby.

Rapid7 published working exploit code on October 13. Its route needs write access to a public project first, a step that disappears on servers where new users can register themselves and create projects. Alpine has not said how its attacker’s configurations reached the server.

Update GitLab, check Ruby, then look for signs of entry

• Upgrade to the newest release on your branch: 19.5.1, 19.4.3, 19.3.6 or 19.2.9. These also carry the October 21 fix for CVE-2026-110264, which GitLab backported to 19.2.9, 19.1.9, 19.0.10 and 18.11.13.
• If you built GitLab from source or run it in your own container image, check ruby -v inside it and move to 3.3.13, 3.4.12, 4.0.9 or later. A GitLab upgrade does not change that Ruby.
• Turn off open sign-up and public project creation for strangers if you do not need them. Rapid7 lists restricting anonymous access to public projects and blocking the CI lint route as stopgaps that cover only its exploit path.
• CISA marks this one for forensic triage, so run the hunt steps below on any server that ran an unfixed build. Our CySA+ exam guide covers the detection and incident-response skills behind them.

Details

• CVE: CVE-2026-97229, integer overflow or wraparound (CWE-190) in the CI/CD regular expression compiler. CVSS 10.0 (GitLab, CVSS 3.1). Affected: GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. GitLab.com and Dedicated were already patched.
• KEV: added October 29, 2026; due November 1, 2026; forensic triage required.
• Ruby fixes: 3.3.13, 3.4.12 and 4.0.9, published October 23 together with other Onigmo compiler fixes tied to GitLab CVEs. Ruby says applications are affected only when they compile a regular expression from attacker-controlled text, and that Regexp.timeout does not protect against it.
• Alpine timeline: fix released October 12; Alpine upgraded to 19.3.4 on October 13; main attack October 21; upgrade to 19.3.6 on October 22; still-vulnerable finding October 26; rebuild finished October 28. Pull alpinelinux/gitlab:19.3.6 again if you use their image; anything pulled before October 27 is vulnerable.

Hunt / verify

• Look for files owned by the git user in /tmp, unexpected child processes of Puma or Sidekiq, outbound connections you cannot explain, and changed crontabs or SSH keys for the git user. These are the checks GitLab’s detection guidance lists.
• Search logs back to October 12 for worker crashes, 502 errors around CI lint requests and accounts registered shortly before them. GitLab published six detection rules for self-managed servers.
• If anything suggests code ran, rotate the secrets in gitlab-secrets.json, every CI/CD variable, every runner token and every access token, as GitLab advises, and consider rebuilding the way Alpine did.

Source: CISA KEV addition, October 29; Alpine Linux incident report

Sources

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 29, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• Alpine Linux: GitLab security incident, attempted exploitation of CVE-2026-97229
• The Hacker News: Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open
• GitLab: Critical Patch Release 19.4.2, 19.3.5, 19.2.8
• GitLab: Critical Patch Release 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13
• Ruby: Regexp compilation fixes related to GitLab’s CVEs
• Rapid7: GitLab CI/CD Regex Integer Overflow technical analysis
• NVD: CVE-2026-97229

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].