Attack on Alpine Linux's GitLab server exposes flaw in Ruby's regex engine
Operators who build GitLab on their own Ruby or container images must patch Ruby as well as GitLab to close the hole.
An attacker tried to exploit CVE-2026-97229, a CVSS 10.0 GitLab flaw, against Alpine Linux's own GitLab server on 20 and 21 October 2026, a week after GitLab shipped a fix. The bug sits in Ruby's Onigmo regex engine rather than in GitLab, so Alpine's upgrade to GitLab 19.3.6 on 22 October left the server exposed because it ran standard Ruby. Operators building GitLab on their own Ruby or container images need Ruby 3.3.13, 3.4.12, 4.0.9 or later in addition to the GitLab upgrade. Alpine saw eight worker crashes and no evidence of code execution, but treated the server as compromised, rebuilt it, and reset all passwords. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and set a short patch deadline for federal agencies.
Why it matters
The flaw sits in a shared component rather than in GitLab alone, so upgrading GitLab by itself leaves installations exposed when they run standard Ruby. Organisations that run GitLab on their own images now have to track two separate fixes, and federal agencies face a short patch deadline because the flaw is already being exploited. The Alpine case shows that even a fast GitLab upgrade does not guarantee safety when the underlying runtime is outdated.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.