SecurityThreats & vulnerabilitiesNote
GitLab’s exploited CVSS 10 flaw is fixed in Ruby, so upgrading GitLab may not close it
GitLab’s 12 and 21 October fixes, Alpine Linux’s account of its attack, CISA’s 29 October listing and Shadowserver’s 1 November count: what is confirmed as of 3 November.
Attackers are exploiting CVE-2026-97229, a flaw rated CVSS 10.0 that lets an attacker run code on a self-managed GitLab server through a crafted regular expression in a CI/CD configuration. GitLab fixed it on 12 October; CISA added it to its catalogue of exploited vulnerabilities on 29 October, with a federal due date of 1 November.12 On 1 November Shadowserver was tracking “over 1000” GitLab instances still vulnerable, and “over 11300” vulnerable to a sibling flaw, CVE-2026-110264, out of about 39,000 it sees daily.6 The catch is where the fix lives: in Ruby, not in GitLab’s own code. Alpine Linux upgraded its GitLab after being attacked, and was still exposed.5
01Two CVSS 10 fixes, both inside Ruby
The bug is in Onigmo, the regular-expression engine built into Ruby. GitLab compiles patterns its users supply, such as those in CI configuration; Ruby’s maintainers say specially crafted patterns could corrupt memory while Ruby compiles them.4 GitLab’s 12 October release (19.4.2, 19.3.5, 19.2.8) fixed CVE-2026-97229 by patching the Ruby it bundles; the patches appear in the release’s bug-fix list, and the CVE entry itself does not mention Ruby.2
On 21 October GitLab fixed CVE-2026-110264, another CVSS 10.0 overflow in the same compiler, affecting “all versions from 7.0” and backported to 18.11. That page carries the warning that matters: if an installation “uses its own Ruby runtime rather than the one bundled in our official packages (for example, a self-compiled installation or a custom container image), upgrading GitLab is not sufficient”; it needs Ruby 3.3.13, 3.4.12, 4.0.9 or later.3 Ruby shipped those releases on 23 October, covering four GitLab CVEs. It has not requested CVE identifiers of its own, and asks users to track the issues under GitLab’s numbers, “for example in a security scanner”.4 So there is no Ruby CVE for a scanner that checks Ruby packages to match.
02Alpine upgraded, and was still open
Alpine’s GitLab was on 19.3.4: on 13 October it installed that instead of 19.3.5 “by mistake”. On 20 and 21 October a newly registered account sent crafted CI configurations that crashed GitLab workers eight times. Alpine upgraded to 19.3.6 on 22 October, which “didn’t fix the vulnerability. The fix isn’t in GitLab’s own code but in a patch to Ruby, which GitLab applies only in its official packages.” Its image used standard Ruby. The attacker returned on 25 and 26 October and failed.5
Alpine was attacked nine days after GitLab’s fix, and its upgrade the next day did not close the hole
GitLab, Rapid7, Alpine Linux, Ruby, CISA and Shadowserver events, 12 October to 1 November 2026
Show tableHide table
| Date | Event | Detail |
|---|---|---|
| 12 Oct 2026 | GitLab fixes CVE-2026-97229 | 19.4.2, 19.3.5, 19.2.8; the fix is a patch to its bundled Ruby |
| 16 Oct 2026 | Rapid7 publishes an exploit | analysis and proof of concept against 19.4.1 |
| 21 Oct 2026 | Alpine’s GitLab attacked | main attack; still on 19.3.4 |
| 21 Oct 2026 | Second CVSS 10 fix | CVE-2026-110264; own-Ruby installs must also upgrade Ruby |
| 22 Oct 2026 | Alpine upgrades, still open | 19.3.6 on standard Ruby |
| 23 Oct 2026 | Ruby ships the fix | 3.3.13, 3.4.12, 4.0.9 |
| 29 Oct 2026 | CISA lists it as exploited | KEV; federal due date 1 November |
| 1 Nov 2026 | 1,000+ still vulnerable | Shadowserver, of about 39,000 instances seen daily |
Source: GitLab patch releases; Rapid7; Alpine Linux incident post; Ruby advisory; CISA KEV feed (version 2026.10.30); Shadowserver · as of 3 November 2026 · The KEV due date binds US federal civilian agencies under BOD 26-04, no one else.
Alpine found no evidence that code ran, “but we cannot rule it out”: by its account a successful exploit would leave no crash, and some logs were gone. It rebuilt the server from scratch, reset every password and replaced GitLab’s secret keys. Its packages and its 21 October releases were checked against records outside GitLab and were not tampered with; its signing keys were never on the server.5
03What GitLab, Ruby and Alpine say to do
- GitLab’s packages or images: upgrade to a current patch release; the 21 October releases also cover CVE-2026-110264. GitLab published threat detections for both, including “Onigmo native worker crash”.3
- Your own Ruby (source installs, custom images): upgrade GitLab and Ruby. Ruby: “If you cannot upgrade, please avoid compiling regular expressions from untrusted input.” Alpine adds that any program doing so is exposed, not only GitLab.45
- Who can reach it: Rapid7’s exploit needs push access to a public project, then an unauthenticated CI lint request; Rapid7 notes this “conflicts with GitLab’s PR:N rating”, and suggests restricting that route as a stopgap that does not repair Ruby.78
Sources
- CISA, Known Exploited Vulnerabilities catalogue, JSON feed (CVE-2026-97229 added 29 October, due 1 November) — 30 October 2026
- GitLab, Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 (CVE-2026-97229) — 12 October 2026
- GitLab, Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 (CVE-2026-110264; guidance for installations not using official packages) — 21 October 2026
- Ruby, Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264 — 23 October 2026
- Alpine Linux, GitLab security incident: attempted exploitation of CVE-2026-97229 — 28 October 2026 Updated 30 October.
- The Shadowserver Foundation, post on Bluesky with dashboard time series, world map and tree map (both CVEs) — 1 November 2026
- Rapid7, Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229) — 16 October 2026
- Rapid7 (jburgess-r7), CVE-2026-97229 proof of concept, README — 13 October 2026 Repository created 13 October; last updated 19 October.
- CERT-In, Vulnerability Note CIVN-2026-0497: Multiple Vulnerabilities in GitLab CE/EE — 13 October 2026
- CERT-In, Vulnerability Note CIVN-2026-0516: Multiple Vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) — 22 October 2026
- CERT-In, Directions under section 70B(6) of the IT Act, 2000 (direction (ii) and Annexure I: six-hour reporting) — 28 April 2022
Related on TechBag: the vulnerability management guide and the GitLab DevSecOps platform page.
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
