Alpine Linux rebuilds GitLab from scratch after attacker nearly exploits a critical Ruby regex flaw
GitLab Security Incident: Attempted Exploitation of CVE-2026-97229
An attacker probed Alpine's GitLab instance on October 20–21 using crafted CI configs against CVE-2026-97229, a CVSS 10.0 flaw in Ruby's Onigmo regex engine. Worker processes crashed eight times, and in four cases the exploit got partway before failing. Alpine found no proof of success but couldn't rule it out, so it rebuilt the instance, reset all passwords, and verified aports and releases were untouched. Upgrading GitLab alone didn't fix it—the patch lives in Ruby.
A successful exploit would leave no crash and no trace in the web logs.
- JLO64
> Upgrading to GitLab 19.3.6 on October 22 didn’t fix the vulnerability. The fix isn’t in GitLab’s own code but in a patch to Ruby, which GitLab applies only in its official packages. Our image used standard Ruby, so it didn’t get the patch.
> The bug is in Ruby’s regular expression engine, so any program that compiles regular expressions from untrusted input is exposed, not only GitLab.
I feel like this era of constant exploits/patches is really bad for those who build from source or make their own images vs those who rely on provided images and upgrade them often. I really can't think of a decent solution for those people other than being plugged in 24/7 to the latest news which is really unfortunate and must be exhausting...
- akersten
> If you use our alpinelinux/gitlab container image, pull alpinelinux/gitlab:19.3.6 again. The image published on October 27 contains Ruby 3.3.13. Any 19.3.6 image you pulled before October 27, and all older tags, are vulnerable.
shouldn't they tag a new version instead of re-releasing a fixed 19.3.6, if earlier 19.3.6 are vulnerable?
- rurban
This was happens when you don't trust existing well-maintained packages, and rather rewrite it by your own. Onigmo should not exist.
Linux has the very same disturbing not invented here syndrome, rewriting good features by their own, making them worse.
- cowlevel
The bug is integer overflow in a random C data-processing library (specifically regexes) leading to RCE.
Who else is tired of C libraries since this week?
- jtchang
This is a fantastic write up on the security incident. Almost any incident like this will have unknowns. It's good to make it explicit. I especially liked the part of what would have been leaked if the attacker was successful. Maybe they could include what type of hash was used.