Do Son 
TL;DR
On October 20 and 21, an attacker tried to exploit a critical GitLab vulnerability on Alpine Linux’s own GitLab server. The flaw, CVE-2026-97229, scores 10.0 on CVSS and can lead to remote code execution. Alpine says the attack “came close to working,” so it rebuilt the whole instance from scratch. The CVE does not yet appear in CISA’s KEV catalog.
An attacker used crafted CI configurations to target an unpatched Alpine Linux GitLab server. Alpine found no proof of success but treated the server as compromised. Alpine packages and releases were not tampered with, according to the project.
- CVE: CVE-2026-97229
- CVSS: 10.0 (Critical · CVSSv3)
- Product: GitLab
- Affected: 19.2, 19.3, 19.4
- Impact: Integer Overflow or Wraparound in GitLab
- Status: Exploited in the wild
- Patched in: 19.2.8, 19.3.5, 19.4.2
- EPSS: 18.4% (30-day)
- Action: Update to 19.2.8, 19.3.5, 19.4.2 now
Why It Matters
This is in-the-wild exploitation of a GitLab vulnerability against a major Linux distribution. Moreover, Alpine notes the attacker “downloaded our GitLab container image.” That “suggests they were tuning the exploit to our exact build.”
The incident also reveals a patching trap. GitLab’s fix is a patch to the Ruby bundled in its official packages. As a result, upgrading GitLab alone did not protect Alpine’s custom image.
How the Attack Works
The bug sits in Onigmo, the regular expression engine built into Ruby. GitLab’s CVE record says a “specially crafted regular expression in a CI/CD configuration” could let an unauthenticated user run code.
In Alpine’s case, a newly registered account sent crafted CI configurations. Those requests crashed GitLab workers eight times. In four crashes, the attacker “got partway through the exploit and failed at the next step.” The attacker returned on October 25 and 26, but those attempts failed.
Affected Versions
- GitLab CE/EE 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2
- Self-built GitLab using Ruby older than 3.3.13, 3.4.12 or 4.0.9
- alpinelinux/gitlab images pulled before October 27
Patch and Mitigation
To close this GitLab vulnerability, upgrade GitLab and, if you use your own Ruby, install Ruby 3.3.13, 3.4.12, 4.0.9 or later. Alpine warns, “upgrading GitLab is not enough.” In addition, Alpine reset all GitLab passwords and replaced its secret keys. Users should also change reused passwords on other sites.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
