Alpine's Two GitLab Upgrades Missed a Fix Hidden in Ruby

Alpine Linux upgraded its GitLab server twice after CVE-2026-97229 was published and was still vulnerable on Oct. 26, because the fix for the flaw sits inside the Ruby interpreter that GitLab bundles, not in GitLab's own code. The distribution's development team said it rebuilt the server from scratch on Oct. 27 and reset every password on Oct. 28.

The account comes from Alpine's own incident post, signed by the Alpine Linux Development Team. It rates the flaw CVSS 10.0, the top of the 10-point severity scale, and places it in Onigmo, the regular expression engine built into Ruby. GitLab evaluates regular expressions that users put in CI configuration files, so a newly registered account can reach the bug.

What happened on Alpine's server

Alpine said GitLab published fixed releases on Oct. 12 and the CVE went public on Oct. 13. That day Alpine upgraded to GitLab 19.3.4 instead of 19.3.5, which carried the fix, by mistake. On Oct. 22 it moved to 19.3.6, and that did not help either, because Alpine's image ran stock Ruby rather than the patched one GitLab ships in its own packages.

An attacker registered an account on Oct. 20 and sent crafted CI configurations on Oct. 21. Alpine counted eight crashes of GitLab worker processes, four of which got partway through the exploit, and users saw 502 errors and failed CI jobs. The account was blocked on Oct. 23. The attacker came back on Oct. 25 and Oct. 26, and those attempts failed.

1. Attacker registers account (Oct. 20)8 days
2. Main attack (Oct. 21)9 days
3. Account blocked (Oct. 23)11 days
4. Rebuild begins (Oct. 27)15 days
5. Rebuild done (Oct. 28)16 days

Source: Alpine Linux incident post, accessed 2026-10-29

What Alpine can and cannot rule out

The team said it found no evidence that the attacker ran code on the server, but it cannot rule it out. Some attack-day logs are gone, and the server did not log outbound network connections.

Alpine said its releases, ISO images, minirootfs tarballs and packages built from Oct. 20 to Oct. 24 were not tampered with, and that signing keys were never stored on the GitLab server. If the attack had succeeded, exposed data would have included user emails, names and IP addresses, password hashes, two-factor secrets, CI variables, runner tokens and private repositories.

The fix lives in Ruby, not GitLab

The Ruby project published an advisory on Oct. 23 tying four GitLab CVEs to bugs in Onigmo. Ruby 4.0.9, 3.4.12 and 3.3.13 contain all four fixes. The advisory says any application that compiles a regex from attacker-controlled text is affected, not just GitLab, and that setting a regex timeout does not protect against these bugs.

GitLab CVE	Ruby bug	First fixed in
CVE-2026-89078	Double free after a failed parse	4.0.0, 3.4.12, 3.3.13
CVE-2026-93577	Integer overflow in pattern size	4.0.8, 3.4.12, 3.3.13
CVE-2026-97229	Same bug as CVE-2026-93577	4.0.8, 3.4.12, 3.3.13
CVE-2026-110264	Overflow of internal IDs in many-repeat patterns	4.0.9, 3.4.12, 3.3.13

Ruby has not requested CVE numbers of its own, at least for now, so a scanner that matches on Ruby version alone will not flag an old interpreter. The Hacker News reported that Ruby 3.2 and earlier get no fix, since 3.2 reached end of life on April 1, 2026. It also reported that a researcher using the handle joaxcar reported all four flaws through GitLab's bug bounty, and that none was in CISA's Known Exploited Vulnerabilities catalog as of Oct. 23.

Alpine's Ruby packages in 3.22, 3.23, 3.24 and edge ship 3.4.12, and 3.21 ships 3.3.13, so apk upgrade picks up the fix. The pattern is familiar from Apple's git and curl certificate store, where trust sits in a layer below the one a changelog describes. It also echoes the OpenCode and Warp backend breaches, where developer tooling carried exposure its users never chose.

Alpine said it will apply critical GitLab security releases within a day, check each for a bundled Ruby patch, log outbound connections, and add signed release tags that can be verified without GitLab. The rebuilt alpinelinux/gitlab:19.3.6 image with Ruby 3.3.13 is published, and users must reset their passwords once GitLab reopens.