Alpine Linux Patched GitLab to 19.3.6 and Was Still Exploitable. The Fix for CVE-2026-97229 Lives in Ruby, and Your Own GitLab Image May Not Have It.
If you run GitLab from your own container image or from source, upgrading GitLab does not fix CVE-2026-97229. You also need Ruby 3.3.13, 3.4.12 or 4.0.9 or later. Alpine Linux found this out during an attack on its own GitLab server, and published the timeline.
What happened at Alpine
This comes from Alpine's own incident post, dated October 28 and updated October 30.
- October 12: GitLab releases the fix for CVE-2026-97229, a CVSS 10.0 integer overflow in how GitLab compiles regular expressions in CI configuration.
- October 13: Alpine upgrades to GitLab 19.3.4 instead of 19.3.5, which had the fix. Alpine calls this a mistake.
- October 20 and 21: A newly registered account sends crafted CI configurations. GitLab worker processes crash 8 times. In 4 of those crashes the attacker got partway through the exploit and failed at the next step. The attacker also downloads Alpine's GitLab container image, which Alpine reads as tuning the exploit to its exact build.
- October 22: Alpine upgrades to 19.3.6.
- October 23: Alpine blocks the account. Ruby publishes its fix the same day.
- October 25 and 26: The attacker returns and fails. On the 26th Alpine finds its instance is still vulnerable after the upgrade.
- October 27 to 29: Alpine closes GitLab, rebuilds it from scratch, resets all passwords, replaces GitLab's secret keys and reopens on 19.3.7.
CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29, eight days after the attack Alpine describes. CISA's entry does not say whose exploitation it relies on, so we are not saying Alpine's incident is the evidence behind the listing.
Why 19.3.6 was not enough
Alpine says the fix "isn't in GitLab's own code but in a patch to Ruby, which GitLab applies only in its official packages. Our image used standard Ruby, so it didn't get the patch." Its image published on October 27 contains Ruby 3.3.13. Any 19.3.6 image pulled before October 27, and all older tags, are vulnerable, according to Alpine.
Ruby's October 23 advisory explains the scope. It covers four bugs in Onigmo, Ruby's regular expression engine, that GitLab fixed under four CVEs. They are reached whenever an application compiles a regular expression from a string an attacker controls. Ruby says Regexp.timeout does not protect against them, and that limiting the length of patterns does not reliably protect either. Ruby 3.3.13, 3.4.12 and 4.0.9 contain all of the fixes.
GitLab's own 19.5.1 release notes list a Ruby regexp patch for Ruby 3.3, 3.4 and 4.0 as an Omnibus and container-build change in the 19.3 branch. That matches Alpine's account: GitLab's packages carry the patch, and a stock-Ruby image does not.
What to check
- If you use GitLab's official packages, upgrade to the fixed build for your branch. Our earlier post has the full table, including the second bug, CVE-2026-110264, which the October 12 builds do not cover.
- If you build your own image or install from source, check the Ruby version inside it. You need 3.3.13, 3.4.12, 4.0.9 or later, whatever GitLab version you run.
- If you pull a community GitLab image, check its build date and Ruby version, not just its GitLab tag. Alpine says its own tags older than October 27 are vulnerable, and a third-party image can have the same gap.
- Turn on GitLab's detections. For this bug GitLab lists six, including "Onigmo native worker crash" and "ci regexp guard rejection". The crashes were how Alpine saw this attack.
- Do not treat a quiet log as clean. Alpine says a successful exploit would leave no crash and no trace in the web logs. Alpine says it found no evidence the attacker ran code on its server, and that it cannot rule it out.
- Reduce exposure while you upgrade. The attacker needed only a self-registered account. Restricting sign-up and public project creation narrows who can reach the vulnerable code path, though it does not fix it.
What we hold, and what we do not
Alpine published no IP addresses, account names, user agents, file paths or hashes. We have nothing to ingest for this incident and we are not going to invent indicators. We also have no sighting of our own. Our edge is not a GitLab server, and nothing here is a detection lead.
Nothing we read says CVE-2026-110264 has been exploited. Alpine names only 97229.
Limits
The timeline, versions and Alpine's claims come from Alpine's post, which we read today. Ruby's version table comes from Ruby's advisory. The GitLab release details come from GitLab's 19.4.2 and 19.5.1 patch pages. We did not read Rapid7's analysis, Alpine's separate reopening post or GitLab's detection pages, and we did not test any exploit. The Ruby version inside Alpine's pre-October 27 image is not stated, so that it lacked the fix is Alpine's claim.
Our earlier coverage: GitLab's Second CVSS 10 Regex Bug in Nine Days and CISA Gave Agencies Until November 1 to Patch GitLab's October 12 Bug.
Five percent of this is wrong somewhere. It always is.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.