Alpine Linux says upgrading its GitLab instance to 19.3.6 on October 22 did not fix CVE-2026-97229, because the fix is a patch to the Ruby that GitLab bundles in its own packages.
Alpine’s incident post says an attacker sent crafted CI configurations to its GitLab on October 20 and 21, a week after GitLab published fixed releases on October 12. The instance was still running 19.3.4. The requests crashed GitLab worker processes eight times, and in four of those crashes the attacker got partway through the exploit and failed at the next step. The attacker also downloaded Alpine’s GitLab container image. In Alpine’s words, “The attack came close to working.”
The October 22 upgrade to 19.3.6 left the hole open. Alpine explains that the underlying bug is in Onigmo, the regular expression engine inside Ruby, and that GitLab applies its fix as patches to Ruby only in its official packages. Alpine’s image used standard Ruby. Upstream Ruby shipped the fix on October 23 in versions 3.3.13, 3.4.12 and 4.0.9.
Alpine found no evidence that the attacker ran code on the server but could not rule it out, so it rebuilt the instance from scratch and reset all passwords. Its checks showed the aports repository, packages and the October 21 releases were not tampered with.
Alpine’s guidance for defenders is that anyone running GitLab with their own Ruby, from source or in a custom container image, needs Ruby 3.3.13, 3.4.12, 4.0.9 or later in addition to the GitLab upgrade. GitLab’s critical patch release notice covers 19.4.2, 19.3.5 and 19.2.8. In our reading, a version check on the GitLab banner is not enough for custom images, and the Ruby version inside the image is the number to verify. Earlier GitLab coverage is in our brief on a CVSS 10 GitLab flaw under active probing, and the case for keeping CI servers off the public internet is in our opinion on self-hosted CI.
Source: Alpine Linux, GitLab security incident: attempted exploitation of CVE-2026-97229
