Alpine Linux rebuilds GitLab after attempted RCE attack

What it is

CVE-2026-97229 is a maximum-severity integer overflow in Onigmo, the regex engine bundled with Ruby. It lets unauthenticated attackers run arbitrary code on a GitLab server. GitLab disclosed it and shipped fixes on 12 October 2026. On 20-21 October, attackers used it against Alpine Linux's GitLab, which hosts repositories, code review, CI jobs and the "aports" package build recipes.

How it works

An attacker submits a specially crafted regular expression in a CI/CD pipeline configuration, under certain conditions. Alpine saw malicious CI configurations cause eight worker crashes. Four were partially successful, and none appeared to go all the way to code execution.

Preconditions / Affected

The fix has two layers, and the page shows how a team can have the first without the second:

• Alpine first ran GitLab 19.3.4. The patched GitLab release was 19.3.5.
• Upgrading to 19.3.6 still left the flaw open. The fix required a patched Ruby, which GitLab's official packages bundle but Alpine's custom container image did not.

Anyone running a self-built or custom GitLab image should check the Ruby version inside it, not only the GitLab version.

What to do

Alpine advises users to reset their GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image published on 27 October 2026, which contains Ruby 3.3.13 and addresses the CVE. Alpine rebuilt its own instance from scratch and reset all passwords.

Caveats

• Alpine found no evidence of code execution or tampering, but missing logs and a lack of outbound connection records mean it cannot rule out compromise. It chose a full rebuild for that reason.
• No tampering was found in repository commits, packages or releases up to 27 October. Signing keys are not stored on the GitLab server, so they could not have been exposed.
• The attackers downloaded Alpine's GitLab container image, which suggests they may have been preparing a supply-chain attack.
• If exploitation had succeeded, the exposed data could include user details, password hashes, 2FA secrets, CI/CD secrets, integration credentials and private project content. None of this is confirmed as compromised.