GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux

On October 20 and 21, an attacker attempted to exploit a critical vulnerability (CVE-2026-97229) in GitLab, a week after the fix was released. The vulnerability affects GitLab's evaluation of regular expressions in CI configuration, and is caused by a flaw in the Onigmo regular expression engine built into Ruby. GitLab released patches on October 12, but they were not applied to the vulnerable instance running version 19.3.4.

The attacker sent crafted CI configurations to the GitLab instance, causing worker processes to crash eight times, with the attacker partially succeeding in four of those crashes. However, no evidence suggests that the attacker executed code on the server. In response, the instance was treated as compromised, rebuilt from scratch, and all passwords were reset.

Users are advised to set a new password when the service reopens. The vulnerability affects users who run GitLab with their own Ruby, as upgrading GitLab alone is not sufficient to fix the issue.

Brief written by urgent.news from Lobsters's own syndicated text. Machine-written — may contain errors; check the original before relying on it.