On October 20 and 21, an attacker attempted to exploit CVE-2026-97229 on the GitLab instance of Alpine Linux, a week after the fix was released. The attack came close to succeeding; the attacker sent crafted CI configurations that crashed GitLab worker processes eight times, with four partial exploits. No evidence of successful code execution was found, but the instance was rebuilt from scratch as a precaution.
The vulnerability is a critical CVSS 10.0 flaw in how GitLab evaluates regular expressions in CI configuration, rooted in the Onigmo regex engine used by Ruby. GitLab released patches on October 12, but the fix only appears in its packaged Ruby versions; the standard Ruby used in custom images remained vulnerable. Upgrading to GitLab 19.3.6 did not apply the Ruby patch, so users running their own Ruby must upgrade to Ruby 3.3.13, Ruby 3.4.12, or Ruby 4.0.9.
The alpinelinux/gitlab:19.3.6 image pulled after October 27 now includes the corrected Ruby. All passwords have been reset, and the service is being retested before reopening. Users who reused passwords should change them elsewhere. For details, see the FAQ below.
Source: Hacker News · Summarized by HeadlinesBriefing