Alpine Linux says GitLab exploit attempt failed, rebuilds instance

Alpine Linux says someone tried to exploit a maximum-severity GitLab vulnerability against its GitLab instance on October 20 and 21, about a week after the flaw was disclosed. The attack failed, but the Linux distribution rebuilt the instance from scratch and reset all passwords.

The bug, tracked as CVE-2026-97229 and rated 10/10, comes from insufficient regular expression validation in Onigmo, Ruby's regular expression engine. GitLab said in an October 12 advisory that it could have let an unauthenticated user run arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration.

According to Alpine, the attacker used a newly registered account to send crafted CI configurations, crashing the worker process. In four of those crashes, the attacker got partway through and failed at the next step. The attacker also downloaded Alpine's GitLab container image, which Alpine says suggests they were tuning the exploit to its exact build. Alpine found no evidence that code ran on the server, but said it cannot rule it out.

Alpine's checks found the aports repository, packages and the October 21 releases were not tampered with. The instance is still being tested before public release, and Alpine warned of automated login attempts using passwords leaked elsewhere.

Because the flaw sits in Ruby rather than GitLab, Alpine says updating to GitLab 19.3.6 did not fix it. Projects running GitLab with their own Ruby, from source or in their own container image, need Ruby 3.3.13, 3.4.12 or 4.0.9 or later as well, Alpine said.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on Thursday, with a November 1 due date under BOD 26-04.

CVE references

CVE-2026-97229