Affected Systems

GitLab versions prior to 19.3.5 (and 19.3.6 without Ruby patch). CVE-2026-97229: maximum-severity integer overflow in Onigmo regex compiler bundled in Ruby. Alpine Linux infrastructure targeted October 20-21; custom container images without Ruby patch remained vulnerable despite GitLab version upgrade.

Exploitation Status

Active exploitation confirmed. Attackers targeted Alpine Linux GitLab instance on October 20-21, 2026, causing eight worker crashes with four partially successful attempts. Attackers downloaded Alpine's GitLab container image, suggesting reconnaissance for supply-chain attack. No confirmed code execution, but compromise cannot be ruled out due to missing logs.

Business Impact

High supply-chain risk: Alpine Linux is widely used as base for Docker containers. Successful compromise could expose user credentials, password hashes, 2FA secrets, CI/CD secrets, integration credentials, and private repositories. Custom GitLab deployments using container images may remain vulnerable even after version upgrades if bundled Ruby is not patched. Organizations using Alpine-based containers or running GitLab in custom environments face potential credential theft and code tampering.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately upgrade GitLab to version 19.3.5 or later AND verify bundled Ruby is version 3.3.13 or later to address CVE-2026-97229
  • If using Alpine Linux GitLab containers, pull alpinelinux/gitlab:19.3.6 (published October 27) or later which includes patched Ruby 3.3.13
  • Force password resets for all GitLab users and rotate 2FA secrets, CI/CD variables, and integration credentials (API tokens, webhooks, OAuth apps)
  • Review GitLab CI/CD pipeline configurations submitted between October 12-27 for suspicious regex patterns or unauthorized job executions
  • Monitor GitLab worker processes for crashes and review application logs for Onigmo/regex-related errors indicating exploitation attempts