A newly registered account sent crafted CI configurations at gitlab.alpinelinux.org on 20 and 21 October. The server ran 19.3.4, five days behind the fix for CVE-2026-97229, a CVSS 10.0 remote code execution bug in GitLab’s regex handling. Worker processes crashed eight times; in four, the attacker stalled on the next step.
They also pulled Alpine’s GitLab container image, which the project read as tuning an exploit to their exact build. The account was blocked on 23 October and failed on return attempts two days later.
Upgrading was not the fix
Alpine moved to 19.3.6 on 22 October and found the server still vulnerable four days later. The patch lives in Onigmo, the regex engine inside Ruby, which GitLab only ships in its own bundled builds. Alpine’s image used stock Ruby, so the release number moved while the bug did not.
Upstream Ruby shipped 3.3.13, 3.4.12 and 4.0.9 on 23 October. Running GitLab against a self-built interpreter needs those versions; pulling alpinelinux/gitlab needs the 27 October rebuild of 19.3.6.
Evidence that no longer exists
Alpine found no delays, no stray files, keys, hooks or processes, and no exfiltration in web or API traffic. That is not proof. A clean exploit leaves no crash and no log entry, background job logs vanished with the old container filesystem, and neither Alpine nor its host recorded outbound connections.
So the project rebuilt from scratch and reset every password. It verified aports commits from 20 to 22 October against 45 builders and a developer clone outside the attacker’s reach, confirming the 21 October releases came from those commits. Signing keys never lived on the forge.
The lesson travels: any application compiling regex from untrusted input carries this bug, not only GitLab.
