Overview
- A newly registered account sent crafted CI configurations that crashed GitLab worker processes eight times and advanced partway through the exploit in four attempts during Oct 20–21, and the attacker also downloaded Alpine’s GitLab container image for tuning.
- The bug is CVE-2026-97229, a CVSS 10.0 regular‑expression integer overflow in Onigmo, Ruby’s regex engine, and the authoritative fix lived in upstream Ruby rather than only in GitLab’s source.
- Alpine’s Oct 13 and Oct 22 upgrades left the instance exposed because their container ran standard Ruby until Alpine republished the 19.3.6 image with Ruby 3.3.13 on Oct 27.
- Because background job logs and the old container filesystem were missing and there was no outbound connection logging, Alpine could not rule out code execution and completed a full rebuild by Oct 28 with all passwords and secret keys reset.
- The incident prompted wider warnings to self‑hosted GitLab operators to update both GitLab and the Ruby runtime, and led Alpine to commit to faster patching, longer log retention, outbound connection logging, and signed release tags while CISA added the CVE to its Known Exploited Vulnerabilities list.