Alpine Linux Rebuilds GitLab Server After Attacker Targets Maximum-Severity Flaw That a Standard Upgrade Missed

Alpine Linux said on 28 October that an attacker tried to exploit a critical GitLab flaw, CVE-2026-97229 (CVSS score: 10.0), on its own GitLab server. The flaw can let an attacker run code on a server through a crafted regular expression in a CI configuration. Alpine found no evidence the attack worked but cannot rule it out, so it rebuilt the server from scratch and reset every account's password.

The fix was more than a GitLab upgrade. GitLab's patches apply to the Ruby that it ships in its own packages and container images, and Alpine's image used standard Ruby. Upgrading to GitLab 19.3.6 on 22 October therefore did not close the hole. Alpine also admitted it had upgraded to 19.3.4 instead of 19.3.5 on 13 October, which it calls a mistake. A new account began probing the server on 20 October, and its crafted requests crashed worker processes 8 times and caused errors and failed CI jobs. The attacker also downloaded Alpine's GitLab container image, which Alpine said suggests they were tuning the exploit to its exact build.

Alpine says packages built from 20 to 24 October, and the 21 October releases, were checked against records outside GitLab, and its signing keys have never been on the server. Anyone running GitLab on their own Ruby needs Ruby 3.3.13, 3.4.12, 4.0.9 or later, and users of the alpinelinux/gitlab image need to pull 19.3.6 again.