Alpine Logged GitLab CVE-2026-97229 Attacks Nine Days Before CISA Listed It

Attackers sent crafted CI configurations to Alpine Linux's self-hosted GitLab on Oct. 20 and 21, causing eight worker crashes, Alpine said in its incident report. The flaw is CVE-2026-97229, a tracking number rated 10.0 out of 10 on the CVSS severity scale. CISA added it to its Known Exploited Vulnerabilities catalog on Oct. 29, per Rapid7, nine days after Alpine's first log entry.

What an attacker needs

The vendor score implies no login. Rapid7 found that an attacker must be able to commit a malicious .gitlab-ci.yml and a repository path with UTF-8 characters to a branch in a public project. On a self-managed instance where anyone can register and create projects, Rapid7 said, that condition disappears. Code runs as the GitLab git user.

The bug is an integer overflow in the CI/CD regular expression compiler. A regex compiles in a compact US-ASCII form and passes GitLab's validation. When it is evaluated against a specially formed UTF-8 path, Ruby's Onigmo engine recompiles it, and the overflow produces invalid instructions that can run an operating-system command. Rapid7 reproduced code execution on the official GitLab 19.4.1 CE image and saw no execution on 19.4.2.

What Alpine saw

Alpine's server ran GitLab 19.3.4. A newly registered account probed it on Oct. 20, and the main attack on Oct. 21 caused crashes, 502 errors and failed CI jobs. In four of the eight crashes the attacker got partway through the exploit before failing at the next step. The attacker also downloaded the GitLab container image, which Alpine reads as tuning the exploit to the exact build.

Alpine found no evidence that attacker code ran but said it cannot rule it out. A successful exploit leaves no crash and no web log, some logs from the attack day are gone, and outbound connections were not logged. It treated the server as compromised, reset all passwords and replaced secret keys. Alpine's release artifacts and packages built Oct. 20 to 24 matched outside records, and its signing keys were never on the GitLab server.

Date	Event
Oct. 12	GitLab releases fixed versions
Oct. 13	Alpine upgrades to 19.3.4 instead of 19.3.5
Oct. 21	Main attack; eight crashes over two days
Oct. 22	Alpine moves to 19.3.6, which is still vulnerable
Oct. 23	Upstream Ruby ships the fix
Oct. 26	Alpine finds the instance still vulnerable
Oct. 29	CISA lists CVE-2026-97229

The version numbers disagree

Rapid7 lists the fixed releases as 19.2.8, 19.3.5 and 19.4.2. BleepingComputer lists 19.3.4 as the fixed 19.3 build, citing GitLab. Alpine's experience supports Rapid7: 19.3.4 was exploitable, and its post says 19.3.5 contained the fix.

A second trap is that the patch lives in Ruby, not in GitLab's source. Alpine's post says GitLab applies it only inside its own packages and images. Alpine's 19.3.6 image, built on stock Ruby, did not have it. Upstream Ruby fixed Onigmo on Oct. 23 in 3.3.13, 3.4.12 and 4.0.9.

BleepingComputer said GitLab credited a researcher using the handle joaxcar through its HackerOne bug bounty program, and that GitLab.com was already patched.

What to do

Self-hosted operators who bring their own Ruby need Ruby 3.3.13, 3.4.12, 4.0.9 or later, in addition to a fixed GitLab. Alpine said anyone using its alpinelinux/gitlab image should pull 19.3.6 again, because any copy pulled before Oct. 27 is vulnerable. Rapid7's stopgap is to restrict anonymous access to public projects and block untrusted users from creating them, which covers only the demonstrated delivery path.

Alpine's server reopened on Oct. 29 on GitLab 19.3.7. It now plans to apply critical GitLab releases within a day, log outbound connections and sign release tags. For other open infrastructure exposure, see the unpatched Linux TCP bug CVE-2026-98432 and the npm worm SafeDep traced.