--- title: "GitLab’s exploited CVSS 10 flaw is fixed in Ruby, so upgrading GitLab may not close it" summary: "GitLab’s 12 and 21 October fixes, Alpine Linux’s account of its attack, CISA’s 29 October listing and Shadowserver’s 1 November count: what is confirmed as of 3 November." url: https://www.thetechbag.com/blog/gitlab-cvss-10-exploited-ruby-patch-alpine format: Note desk: "Security" area: "Threats & vulnerabilities" region: Global published: 2026-11-03 facts_checked: 2026-11-03 author: TechBag (The TechBag Journal) tags: ["GitLab","CVE-2026-97229","CVE-2026-110264","Ruby","Onigmo","Alpine Linux","CISA KEV","BOD 26-04","Shadowserver","Rapid7","self-managed GitLab","CI/CD","CERT-In"] cover: https://www.thetechbag.com/blog/covers/gitlab-cvss-10-exploited-ruby-patch-alpine.png --- # GitLab’s exploited CVSS 10 flaw is fixed in Ruby, so upgrading GitLab may not close it *GitLab’s 12 and 21 October fixes, Alpine Linux’s account of its attack, CISA’s 29 October listing and Shadowserver’s 1 November count: what is confirmed as of 3 November.* Note · Security · Threats & vulnerabilities · By TechBag · Published 2026-11-03 · Facts checked 2026-11-03 · Canonical: https://www.thetechbag.com/blog/gitlab-cvss-10-exploited-ruby-patch-alpine Attackers are exploiting CVE-2026-97229, a flaw rated CVSS 10.0 that lets an attacker run code on a self-managed GitLab server through a crafted regular expression in a CI/CD configuration. GitLab fixed it on 12 October; CISA added it to its catalogue of exploited vulnerabilities on 29 October, with a federal due date of 1 November.[1][2] On 1 November Shadowserver was tracking “over 1000” GitLab instances still vulnerable, and “over 11300” vulnerable to a sibling flaw, CVE-2026-110264, out of about 39,000 it sees daily.[6] The catch is where the fix lives: in Ruby, not in GitLab’s own code. Alpine Linux upgraded its GitLab after being attacked, and was still exposed.[5] ## Two CVSS 10 fixes, both inside Ruby The bug is in Onigmo, the regular-expression engine built into Ruby. GitLab compiles patterns its users supply, such as those in CI configuration; Ruby’s maintainers say specially crafted patterns could corrupt memory while Ruby compiles them.[4] GitLab’s 12 October release (19.4.2, 19.3.5, 19.2.8) fixed CVE-2026-97229 by patching the Ruby it bundles; the patches appear in the release’s bug-fix list, and the CVE entry itself does not mention Ruby.[2] On 21 October GitLab fixed CVE-2026-110264, another CVSS 10.0 overflow in the same compiler, affecting “all versions from 7.0” and backported to 18.11. That page carries the warning that matters: if an installation “uses its own Ruby runtime rather than the one bundled in our official packages (for example, a self-compiled installation or a custom container image), upgrading GitLab is not sufficient”; it needs Ruby 3.3.13, 3.4.12, 4.0.9 or later.[3] Ruby shipped those releases on 23 October, covering four GitLab CVEs. It has not requested CVE identifiers of its own, and asks users to track the issues under GitLab’s numbers, “for example in a security scanner”.[4] So there is no Ruby CVE for a scanner that checks Ruby packages to match. ## Alpine upgraded, and was still open Alpine’s GitLab was on 19.3.4: on 13 October it installed that instead of 19.3.5 “by mistake”. On 20 and 21 October a newly registered account sent crafted CI configurations that crashed GitLab workers eight times. Alpine upgraded to 19.3.6 on 22 October, which “didn’t fix the vulnerability. The fix isn’t in GitLab’s own code but in a patch to Ruby, which GitLab applies only in its official packages.” Its image used standard Ruby. The attacker returned on 25 and 26 October and failed.[5] **Figure: Alpine was attacked nine days after GitLab’s fix, and its upgrade the next day did not close the hole** *GitLab, Rapid7, Alpine Linux, Ruby, CISA and Shadowserver events, 12 October to 1 November 2026* | Date | Event | Detail | | --- | --- | --- | | 12 Oct 2026 | GitLab fixes CVE-2026-97229 | 19.4.2, 19.3.5, 19.2.8; the fix is a patch to its bundled Ruby | | 16 Oct 2026 | Rapid7 publishes an exploit | analysis and proof of concept against 19.4.1 | | 21 Oct 2026 | Alpine’s GitLab attacked | main attack; still on 19.3.4 | | 21 Oct 2026 | Second CVSS 10 fix | CVE-2026-110264; own-Ruby installs must also upgrade Ruby | | 22 Oct 2026 | Alpine upgrades, still open | 19.3.6 on standard Ruby | | 23 Oct 2026 | Ruby ships the fix | 3.3.13, 3.4.12, 4.0.9 | | 29 Oct 2026 | CISA lists it as exploited | KEV; federal due date 1 November | | 1 Nov 2026 | 1,000+ still vulnerable | Shadowserver, of about 39,000 instances seen daily | Source: GitLab patch releases; Rapid7; Alpine Linux incident post; Ruby advisory; CISA KEV feed (version 2026.10.30); Shadowserver · as of 3 November 2026 · The KEV due date binds US federal civilian agencies under BOD 26-04, no one else. Alpine found no evidence that code ran, “but we cannot rule it out”: by its account a successful exploit would leave no crash, and some logs were gone. It rebuilt the server from scratch, reset every password and replaced GitLab’s secret keys. Its packages and its 21 October releases were checked against records outside GitLab and were not tampered with; its signing keys were never on the server.[5] TechBag countTechBag count and arithmetic On Shadowserver’s rounded figures, about 3% of the GitLab instances it sees daily were open to the exploited flaw on 1 November and about 29% to the newer one. Ruby’s upstream fix came 11 days after GitLab’s. In CISA’s feed, GitLab has six entries since November 2021, four of them added in 2026. ## What GitLab, Ruby and Alpine say to do - **GitLab’s packages or images:** upgrade to a current patch release; the 21 October releases also cover CVE-2026-110264. GitLab published threat detections for both, including “Onigmo native worker crash”.[3] - **Your own Ruby** (source installs, custom images): upgrade GitLab and Ruby. Ruby: “If you cannot upgrade, please avoid compiling regular expressions from untrusted input.” Alpine adds that any program doing so is exposed, not only GitLab.[4][5] - **Who can reach it:** Rapid7’s exploit needs push access to a public project, then an unauthenticated CI lint request; Rapid7 notes this “conflicts with GitLab’s PR:N rating”, and suggests restricting that route as a stopgap that does not repair Ruby.[7][8] In India CERT-In covered the first flaw in CIVN-2026-0497 on 13 October, rated High, and the second in CIVN-2026-0516 on 22 October, rated Critical. Neither note mentions Ruby or exploitation.[9][10] Shadowserver’s map of 1 November counts 238 vulnerable IP addresses in India for the two flaws combined.[6] CERT-In’s Directions of 28 April 2022 list “Unauthorised access of IT systems/data” among incidents to report within 6 hours of noticing.[11] GitLab’s self-managed and Dedicated options are on our [GitLab page](https://www.thetechbag.com/gitlab). How we did this Figures as of 3 November 2026, 7pm IST Flaw details, versions and the Ruby guidance are quoted from GitLab’s and Ruby’s pages; the attack is Alpine’s own account. KEV counts are ours, from CISA’s JSON feed (version 2026.10.30), by `dateAdded`. Exposure counts are Shadowserver’s, from its post; the India figure is read from its dashboard image and combines both CVEs. Percentages are our arithmetic on rounded figures. CVE-2026-110264 is not in the KEV catalogue; we found no report of it being exploited. How CISA’s deadlines work is in [our piece on BOD 26-04](https://www.thetechbag.com/blog/cisa-exploited-flaw-deadline-21-days-to-3); the last run of critical fixes in [six days from patch to exploited](https://www.thetechbag.com/blog/one-week-php-node-java-oracle-critical-patches). Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [CISA, Known Exploited Vulnerabilities catalogue, JSON feed (CVE-2026-97229 added 29 October, due 1 November)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — 30 October 2026 2. [GitLab, Critical Patch Release: 19.4.2, 19.3.5, 19.2.8 (CVE-2026-97229)](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/) — 12 October 2026 3. [GitLab, Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13 (CVE-2026-110264; guidance for installations not using official packages)](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/) — 21 October 2026 4. [Ruby, Regexp compilation fixes related to GitLab's CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264](https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/) — 23 October 2026 5. [Alpine Linux, GitLab security incident: attempted exploitation of CVE-2026-97229](https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html) — 28 October 2026 Updated 30 October. 6. [The Shadowserver Foundation, post on Bluesky with dashboard time series, world map and tree map (both CVEs)](https://bsky.app/profile/shadowserver.bsky.social/post/3mzboqjnq2s2v) — 1 November 2026 7. [Rapid7, Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)](https://www.rapid7.com/blog/post/ra-gitlab-ci-cd-regex-integer-overflow-technical-analysis-cve-2026-97229/) — 16 October 2026 8. [Rapid7 (jburgess-r7), CVE-2026-97229 proof of concept, README](https://github.com/jburgess-r7/CVE-2026-97229-PoC) — 13 October 2026 Repository created 13 October; last updated 19 October. 9. [CERT-In, Vulnerability Note CIVN-2026-0497: Multiple Vulnerabilities in GitLab CE/EE](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0497) — 13 October 2026 10. [CERT-In, Vulnerability Note CIVN-2026-0516: Multiple Vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE)](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0516) — 22 October 2026 11. [CERT-In, Directions under section 70B(6) of the IT Act, 2000 (direction (ii) and Annexure I: six-hour reporting)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022 Related on TechBag: the [vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) and the [GitLab DevSecOps platform page](https://www.thetechbag.com/gitlab/gitlab-devsecops-platform). **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [GitLab intel hub](https://www.thetechbag.com/gitlab) — the DevSecOps platform, and its self-managed and Dedicated options - [Vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — the scanners that find, rank and track flaws like this one - [Exploited flaws now get 3 days, not 21](https://www.thetechbag.com/blog/cisa-exploited-flaw-deadline-21-days-to-3) — how CISA's KEV due dates work under BOD 26-04