{
  "id": 16972309,
  "title": "GitLab security incident: attempted exploitation of CVE-2026-97229 | Alpine Linux",
  "url": "https://urgent.news/2026/10/28/gitlab-security-incident-attempted-exploitation-of-cve-2026-97229",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-28T23:01:26.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html"
  },
  "original_language": "en",
  "account": "On October 20 and 21, an attacker attempted to exploit a critical vulnerability (CVE-2026-97229) in GitLab, an open-source web-based Git repository manager. This occurred just a week after the vulnerability was patched. The attacker's efforts were close to succeeding, but no evidence confirms the exploit was fully successful. Consequently, GitLab treated the affected instance as compromised and rebuilt it from scratch.\n\nThe vulnerability lies in how GitLab evaluates regular expressions in its CI configuration. It affects multiple versions of GitLab, all of which were running on the compromised instance. The underlying bug resides in Onigmo, the regular expression engine embedded in Ruby.\n\nThe attacker registered a new account and sent crafted CI configurations to the GitLab instance, which was running version 19.3.4. This prompted GitLab worker processes to crash multiple times. Four of these crashes allowed the attacker to get partway through the exploit before failing at the next step. The attacker also downloaded the GitLab container image, indicating they were fine-tuning the exploit for the specific build.\n\nDespite attempting to upgrade GitLab to version 19.3.6 on October 22, the vulnerability remained unaddressed. This is because the fix lies in a patch to Ruby, which GitLab only applies in its official packages. Since our image used standard Ruby, it lacked the patch.\n\nFor users running GitLab with their own Ruby (from source or in their own container image), upgrading GitLab is insufficient; they too need to use Ruby 3.3.13, 3.4.12, or 4.0.9 or later. Users utilizing the alpinelinux/gitlab container image should pull the image again, as the one published on October 27 contains Ruby 3.3.13.\n\nIf the attack had succeeded, sensitive data could have been exposed. Since the possibility of code execution cannot be ruled out, and evidence confirming a successful exploit no longer exists, GitLab decided to rebuild the instance from scratch. This action eliminates any potential foothold left by a successful exploit. While GitLab is offline, package mirrors, cgit, mailing lists/IRC remain accessible. The aports repository, packages, and releases post-dating October 20 have been checked and found unaltered. All commits added during this period arrived through a recorded push by known developers. The GitLab rebuild included verification of all packages built between October 20 and 24 across all architectures, ensuring they originated from the published git.alpinelinux.org commits. The October 21 releases (3.21.9, 3.22.7, 3.23.7, 3.24.3) were constructed from these confirmed commits. GitLab remained vulnerable until its closure on October 27, so the security checks were extended to this date. The Ruby regular expression engine flaw makes any program that compiles regular expressions from untrusted input vulnerable, not just GitLab. Alpine Linux versions 3.22, 3.23, 3.24, and edge ship Ruby 3.4.12, while Alpine 3.21 includes Ruby 3.3.13, both containing the fix. To update, run apk upgrade.",
  "summary": "On October 20 and 21, an attacker attempted to exploit a critical vulnerability (CVE-2026-97229) in GitLab, a week after the fix was released. The vulnerability affects GitLab's evaluation of regular expressions in CI configuration, and is caused by a flaw in the Onigmo regular expression engine built into Ruby. GitLab released patches on October 12, but they were not applied to the vulnerable instance running version 19.3.4. The attacker sent crafted CI configurations to the GitLab instance, causing worker processes to crash eight times, with the attacker partially succeeding in four of those crashes. However, no evidence suggests that the attacker executed code on the server. In response, the instance was treated as compromised, rebuilt from scratch, and all passwords were reset. Users are advised to set a new password when the service reopens. The vulnerability affects users who run GitLab with their own Ruby, as upgrading GitLab alone is not sufficient to fix the issue.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "TechSpot",
        "title": "Kali Linux 2026.3 adds six security tools, updated KDE Plasma and Linux kernel",
        "url": "https://urgent.news/2026/10/28/kali-linux-2026-3-adds-six-security-tools-updated-kde-plasma-and",
        "published": "2026-10-28T17:35:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}