Alpine Linux rebuilds GitLab server after exploit attempts
Alpine reset all GitLab passwords and ruled out tampered packages, though missing logs prevent a full ruling-out of compromise.
Alpine Linux rebuilt its GitLab server from scratch and reset all passwords after attackers attempted to exploit a critical GitLab vulnerability on October 20-21, according to bleepingcomputer.com. The attacks targeted CVE-2026-97229, a maximum-severity remote code execution flaw in the Onigmo regex Compiler bundled in Ruby.
Attackers submitted malicious CI configurations over the two days, causing eight worker crashes. Four of those attempts were partially successful, the project said.
Alpine Linux found no evidence that code was executed or that packages were tampered with in releases up to October 27. The project said it could not fully rule out compromise because logs and outbound connection records were Missing.
According to the report, the attackers also downloaded Alpine's GitLab container image, which the project said suggests possible preparation for a supply-chain attack. The GitLab instance hosts development repositories, code reviews and CI jobs, including the aports build recipes for Alpine's packages.
Patch history and guidance
GitLab disclosed CVE-2026-97229 and made fixes available on October 12, warning that a crafted regular expression in a CI/CD pipeline configuration could trigger it. Alpine initially installed GitLab 19.3.4 instead of the patched 19.3.5, and a later upgrade to 19.3.6 failed to close the flaw because the fix required a Ruby patch not included in Alpine's custom container image.
Alpine advises users to reset their GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image published on October 27, which contains Ruby 3.3.13 and fixes CVE-2026-97229.
Quick answers
What is CVE-2026-97229?
It is a maximum-severity remote code execution flaw in GitLab's Onigmo regex Compiler, which is bundled in Ruby. GitLab disclosed it and released fixes on October 12.
Which GitLab image should Alpine users pull?
Alpine advises pulling the alpinelinux/gitlab:19.3.6 image published on October 27, which contains Ruby 3.3.13 and fixes the vulnerability.
Were Alpine packages compromised?
Alpine found no evidence of executed code or tampered packages in releases up to October 27, but said it could not rule out compromise because logs and outbound connection records were Missing.