CISA lists maximum-severity GitLab flaw CVE-2026-97229 as exploited after attempted attack on Alpine Linux

TLDR

• CISA added GitLab CVE-2026-97229, a CVSS 10.0 code execution flaw, to its Known Exploited Vulnerabilities Catalog on 29 October.¹³
• Alpine Linux says an attacker targeted its GitLab on 20 and 21 October and it cannot rule out compromise.²
• Upgrading GitLab alone did not fix Alpine's server; installs using their own Ruby also need 3.3.13, 3.4.12, 4.0.9 or later.²⁴

On 29 October CISA added two flaws to its Known Exploited Vulnerabilities Catalog "based on evidence of active exploitation": GitLab CVE-2026-97229 and a Cisco Secure Firewall ASA and FTD flaw, CVE-2026-76418.¹ CISA lists the GitLab entry as an integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition.¹ GitLab's advisory, dated 12 October, rates it critical at CVSS 10.0 and says that, under certain conditions, an unauthenticated user could execute arbitrary code on the server through a specially crafted regular expression in a CI/CD configuration.³ It was fixed in GitLab 19.4.2, 19.3.5 and 19.2.8, and GitLab says GitLab.com is already patched.³ GitLab also released six threat detections for self-managed instances, and BleepingComputer reports this followed GitLab detecting exploitation attempts.³⁵ CISA's alert does not describe the exploitation it cites; The Hacker News reports the listing relates to an incident Alpine Linux disclosed.¹⁸

Alpine said on 28 October that a newly registered account sent crafted CI configurations to its GitLab instance on 20 and 21 October, crashing GitLab worker processes eight times.² In four of those crashes the attacker got partway through the exploit and failed at the next step, and the attacker also downloaded Alpine's GitLab container image, which Alpine says suggests the exploit was being tuned to its exact build.² The server was still on GitLab 19.3.4, which Alpine says it installed on 13 October instead of 19.3.5 by mistake.² The attacker returned on 25 and 26 October, but those attempts failed.² Alpine says it found no evidence the attacker's code ran, but cannot rule it out because a successful exploit would leave no crash or web-log trace, some logs from the attack day are gone, and outbound connections were not logged.² It therefore treated the instance as compromised and rebuilt it, and says its aports repository, packages and the 21 October releases were not tampered with and that its signing keys have never been stored on the GitLab server.² Alpine lists email addresses, password hashes, 2FA secrets, CI/CD variables and runner tokens among the data that could have been exposed had the attack worked.² An update at the top of Alpine's post, headed 30 October, says GitLab is open again, while the incident timeline in the same post lists the reopening on 29 October, and SecurityWeek, published on 30 October, describes the instance as still being tested.²⁶

The root cause explains why upgrading did not help. Alpine says the bug is in Onigmo, the regular expression engine built into Ruby, and that GitLab's fix is a set of patches to the Ruby it bundles in its own packages and container images, whereas Alpine's image used standard Ruby, so moving to GitLab 19.3.6 on 22 October left it vulnerable.² Ruby's 23 October advisory maps CVE-2026-97229, together with CVE-2026-93577, to an integer overflow in the size of a compiled pattern, and says Ruby 4.0.9, 3.4.12 and 3.3.13 contain the fixes.⁴ Alpine says upstream Ruby shipped the fix on 23 October, The Hacker News says Ruby's fixed versions came out on 22 and 23 October, and Ruby's table lists 4.0.8 as the first 4.0 release with this fix.²⁷⁴ Ruby says the bugs are reachable only when an application compiles a regular expression from attacker-controlled text, and that Regexp.timeout does not protect against them.⁴ The same Ruby advisory lists CVE-2026-110264 as a separate overflow, fixed in GitLab 19.5.1.⁴ The Hacker News reports that, as of 29 October, GitLab's 12 and 21 October patch posts do not tell self-compiled administrators to update Ruby, and that Ruby 3.2 will not get the fix.⁷

On exploitability, The Hacker News reports that Rapid7 published proof-of-concept code on 13 October that ran commands as GitLab's git user on an unpatched official 19.4.1 image but not on the patched 19.4.2 image.⁷ It reports that Rapid7's route needs write access first, with the attacker committing a malicious .gitlab-ci.yml and a file path with UTF-8 characters to a branch of a public project, a step that does not apply where new users can register and create projects.⁷ It adds that Alpine has not said how its attacker's configurations reached GitLab.⁷ BleepingComputer cites Shadowserver as tracking nearly 2,800 internet-exposed GitLab Community Edition instances, without saying how many are patched.⁵ CISA's alert does not state a due date and refers federal agencies to Binding Operational Directive 26-04.¹ The Hacker News gives 1 November 2026 as the deadline, BleepingComputer says Sunday, and SecurityWeek says three days.⁸⁵⁶

Why it matters: a maximum-severity code execution flaw in GitLab is now on CISA's exploited list, and for installs that supply their own Ruby the fix depends on the Ruby version as well as the GitLab upgrade.¹²³⁴