An attacker attempted to exploit CVE-2026-97229 — a CVSS 10.0 integer-overflow flaw in GitLab Community and Enterprise Editions that allows unauthenticated code execution via a crafted regular expression in CI configuration — against the Alpine Linux project's own GitLab server, a week after GitLab shipped its fix. Alpine found no evidence the attempt succeeded but could not rule it out, rebuilding the server from scratch and resetting every account password. Critically, Alpine's GitLab image used standard Ruby, so upgrading to GitLab 19.3.6 on 22 October did not address the issue: the root cause sits in Ruby's regex engine, and installations running their own Ruby need 3.3.13, 3.4.12, 4.0.9 or later. CISA added the flaw to KEV on 29 October, confirming catalogue-wide attention. Any organisation running self-managed GitLab with a custom Ruby must treat the Ruby version, not just the GitLab version, as the patching unit.
| Attribute | Detail |
|---|---|
| Sector | Global (Macro) |
| Date | 2026-10-30 |
| Source | The Hacker News |
| Reliability | Tier 2 |
| CVEs | CVE-2026-97229 |
Escalation — Alpine Linux rebuilds its GitLab from scratch after attempted RCE exploitation (2026-11-01)
The Alpine Linux project rebuilt its GitLab server and reset all passwords after attackers tried to exploit a maximum-severity flaw in its development infrastructure on 20–21 October. The targets were CVE-2026-97229, an integer-overflow remote-code-execution bug in GitLab's CI/CD regular-expression compiler (Onigmo, bundled in Ruby), disclosed and patched on 12 October; the attacker submitted malicious CI configurations, repeatedly crashing GitLab processes, with eight worker crashes and four partially successful attempts that did not go all the way. Alpine could not rule out code execution because the logs that would have confirmed it no longer exist, so it "took the harder route and rebuilt the GitLab instance from scratch." The team found the attackers downloaded its GitLab container image, suggesting preparation for a supply-chain attack, but no tampering in commits, packages or releases up to 27 October. Alpine initially installed GitLab 19.3.4 and then 19.3.6, but neither closed the flaw because the fix required a Ruby patch bundled in GitLab's official packages but absent from Alpine's own image. Its GitLab instance hosts the "aports" build recipes behind Alpine's packages — the base of many Docker images — making it a high-value supply-chain target.