Update, Nov. 1: Alpine Linux has warned that copies of its community GitLab container image pulled before Oct. 27 remain vulnerable and that users should pull the rebuilt image, which carries the patched Ruby, BleepingComputer reported Sunday. Alpine said that if the exploit worked, the attacker could have reached users' password hashes, two-factor authentication secrets, build secrets and integration credentials, though no such compromise has been confirmed. Its incident report adds that the attacker returned Oct. 25 and 26 and failed to regain access, and that the rebuilt server has since reopened.
The Cybersecurity and Infrastructure Security Agency (CISA) Thursday gave federal civilian agencies until Nov. 1 to fix a maximum-severity GitLab flaw, after the Alpine Linux project disclosed that an attacker had aimed it at its code-hosting server. Because the bug sits in the Ruby programming language's pattern-matching engine, organizations that upgraded GitLab may still be exposed.
What Happened
CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog, the government's list of flaws confirmed under attack, in an alert that also listed the Cisco firewall VPN flaw The Primary Wire reported Thursday. Under Binding Operational Directive 26-04, agencies must also perform forensic triage, checking whether a system was compromised before it was patched. CISA lists ransomware use as unknown.
GitLab fixed the flaw Oct. 12 and rated it 10.0 out of 10, as The Primary Wire reported at the time. It is an integer overflow, a number outgrowing the space reserved for it, triggered by a crafted regular expression, a text-matching pattern, in a CI/CD configuration, the file that drives automated builds. Someone without an account could run code on the server.
Alpine Linux, a lightweight open-source operating system common in containers, said in an incident report that a newly registered account sent crafted configurations to its self-hosted GitLab on Oct. 20 and 21, crashing worker processes eight times. The attacker also downloaded Alpine's GitLab container image, which Alpine read as tailoring the exploit to its build.
Alpine found no evidence that code ran but said it could not rule it out, because a successful exploit leaves no crash or web-log trace and outbound connections were not logged. It rebuilt the server, reset all passwords and replaced secret keys. Releases and packages were checked against records outside GitLab, and package signing keys were never stored there, Alpine said.
Why It Matters
The root bug is in Onigmo, Ruby's regular expression engine. GitLab ships its fix as a Ruby patch only in its official packages, so Alpine's Oct. 22 GitLab upgrade left it exposed: its build used standard Ruby. The Ruby project released fixes Oct. 23 and warned that any Ruby application compiling patterns from attacker-controlled text is at risk. Ruby has not requested its own CVE identifiers, so scanners that track only GitLab's IDs may miss vulnerable Ruby installations.
Self-hosted GitLab servers hold source code, build secrets and deployment credentials, which makes them a route into a company's software supply chain. Executives should ask whether teams confirmed the Ruby version, not only the GitLab version.
What to Watch
- Agency compliance with the Nov. 1 deadline and any reports of attacks on other self-hosted GitLab servers.
- Whether other Ruby applications prove exploitable through the same engine. GitLab fixed a second 10.0-rated flaw in it Oct. 21, The Primary Wire reported.
