Alpine Linux Says GitLab CVE-2026-97229 Exploit Attempt Failed
Summary
Alpine Linux says attackers targeted its GitLab instance with CVE-2026-97229 on October 20–21, crashing workers. It found no evidence of code execution or repository tampering, but cannot rule out execution. The flaw remains in Ruby, and CISA added it to KEV.
Key points
- CVE-2026-97229 is a critical code-execution flaw caused by insufficient regular-expression validation in Onigmo, Ruby’s regular-expression engine.
- Alpine Linux says attackers used a newly registered account to submit crafted CI configurations, crashing its GitLab worker process.
- Alpine says four crashes showed the attacker partway through the exploit; downloading its GitLab container image suggested they were tuning the exploit to Alpine’s build.
- Alpine found no evidence that code ran on the server or that its repositories, packages, or October 21 releases were tampered with, but said it could not rule out code execution.
- Alpine rebuilt the instance, reset passwords, and is testing the GitLab instance before returning it to public use.
- Updating GitLab alone does not fix the flaw when using a separately built Ruby; Alpine specifies Ruby 3.3.13, 3.4.12, or 4.0.9 and later.
- CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and directed federal agencies to patch within three days.
Article Details
- Vulnerability Types
- Insufficient regular expression validation enabling unauthenticated remote code execution
- Severity
- Critical (CVSS 10/10)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
Vendors
Products
GitLabA recent code execution vulnerability in GitLab was exploited one week after disclosure in a failed attack against Alpine Linux’s instance.RubyTracked as CVE-2026-97229 (CVSS score of 10/10), the flaw stems from insufficient regular expression validation in Onigmo, Ruby’s regular expression engine.