Overview
- An attacker submitted malicious CI configurations that probed CVE-2026-97229 and repeatedly crashed Alpine’s self-hosted GitLab on Oct. 20–21 while downloading the project's GitLab container image.
- CVE-2026-97229 is a maximum-severity integer-overflow remote code execution flaw in the Onigmo regular-expression engine bundled in Ruby that can let unauthenticated pipeline input run code on a GitLab server.
- Alpine had upgraded GitLab but used a custom container image that still bundled an unpatched Ruby binary so the vulnerability remained exposed until the runtime was updated.
- Because key logs and outbound connection records were missing, Alpine found no confirmed tampering but rebuilt the GitLab server, rotated keys and secrets, forced password resets, and published a patched image (alpinelinux/gitlab:19.3.6 with Ruby 3.3.13).
- Authorities and experts warn other self-hosted GitLab administrators to apply GitLab and Ruby patches, review telemetry for exploitation indicators, rotate secrets, and audit CI configurations to reduce supply-chain and CI/CD risk.