By ByteBot
Alpine Linux’s GitLab instance was attacked eight times last week. The attacker exploited CVE-2026-97229 — a CVSS 10.0 unauthenticated remote code execution flaw in GitLab’s CI/CD regex compiler — crashing worker processes repeatedly and achieving partial exploit success in four of those attempts. Alpine found no confirmed breach but rebuilt the entire instance from scratch anyway. If you’re running a self-managed GitLab, the question isn’t whether to patch. It’s whether your patch actually fixed the underlying problem.
What Happened to Alpine Linux
On October 20, an attacker registered an account on Alpine’s GitLab instance and began probing. The following day, they pushed crafted .gitlab-ci.yml configurations that crashed GitLab’s worker processes eight times. In four of those crashes, the attacker got partway through the exploit chain and stalled at the next step. Alpine found no evidence that code ran successfully on the server — but the team noted something unsettling in their incident report: “A successful exploit would leave no crash and no trace in the web logs.” The 502 errors they observed were the attacker failing. A clean log is not an all-clear.
By October 28, Alpine had shut down GitLab, rebuilt the instance from scratch, and rotated all passwords and secret keys. They also committed to applying critical GitLab patches within 24 hours of release going forward — a standard that most self-managed deployments quietly miss.
Patching GitLab Is Not Enough
This is where most coverage stops short. CVE-2026-97229 lives in Onigmo, Ruby’s regular expression engine. GitLab’s October 12 patch works by shipping a patched Ruby binary inside its own packages and container images. But upstream Ruby didn’t release the Onigmo fix until October 23 — eleven days later — in Ruby 3.3.13, 3.4.12, and 4.0.9.
If your GitLab instance uses a system-installed Ruby or a Ruby that lives in a separate container layer outside GitLab’s official packages, upgrading GitLab to 19.3.5 or 19.4.2 on October 12 fixed the GitLab binary but left the underlying Onigmo bug intact. A vulnerability scanner may flag your GitLab package as patched while the Ruby runtime in a separate image layer stays exploitable. Alpine upgraded GitLab on October 13 and was still fully vulnerable through October 22 for exactly this reason.
How the Exploit Works
No login required. An attacker creates a project on your GitLab instance and pushes a .gitlab-ci.yml containing a crafted regular expression with Unicode/UTF-8 characters. GitLab’s CI lint endpoint — which validates CI configuration files and accepts unauthenticated requests — compiles the regex. A Unicode path triggers recompilation after GitLab’s own size check, causing an integer overflow in Onigmo that redirects execution to a command function. Code runs as the git account on your server. The worker crashes with an HTTP 502, which is the only visible signal that something happened.
CVE-2026-97229 is the third related bug found in GitLab’s regex compiler within three weeks. Its predecessor, CVE-2026-93577, required authentication. This one does not. That trajectory is worth paying attention to. Ruby’s October 23 security advisory covers four CVEs in the same Onigmo compiler — CVE-2026-89078, CVE-2026-93577, CVE-2026-97229, and CVE-2026-110264 — all found during GitLab’s investigation.
What to Do Now
Check your GitLab version first. You need 19.2.8, 19.3.6, or 19.4.2 at minimum. Then check your Ruby version — it must be 3.3.13 or later (Ruby 3.3 branch), 3.4.12 or later (Ruby 3.4 branch), or 4.0.9 or later. If both checks don’t pass, you are not protected.
# Check GitLab version
gitlab-rake gitlab:env:info | grep "GitLab version"
# Check Ruby version
ruby --versionIf your instance was internet-facing between October 12 and October 22 — the gap between GitLab’s patch and Ruby’s upstream fix — treat it as potentially compromised regardless of what your logs say. Rotate everything the server could have accessed: CI/CD variables, AWS access keys, cloud credentials, Docker registry passwords, GitHub personal access tokens, deploy keys, and runner registration tokens.
Audit your CI lint endpoint logs for HTTP 502 errors during that window. Review any recent .gitlab-ci.yml changes for regex patterns you don’t recognize. Help Net Security’s advisory covers the full remediation checklist if you need the complete picture.
GitLab.com and GitLab Dedicated customers are already protected. This affects self-managed instances only.
The Self-Managed Tradeoff
Four CVEs in the same Ruby regex compiler in three weeks, with privilege requirements dropping from “authenticated” to “none.” That’s not a streak of bad luck — that’s a systemic problem in Onigmo that will generate more findings as researchers look harder. If your organization can’t commit to patching critical GitLab releases within 24 hours of disclosure, GitLab.com removes this class of risk entirely. The control you gain from self-managing is real, but so is the burden.
