Alpine Linux reported that an attacker attempted to exploit CVE-2026-97229, a critical CVSS 10.0 GitLab vulnerability rooted in the Ruby Onigmo regex engine, on October 20–21 — one week after the patch was released but before Alpine applied it. The attack crashed GitLab worker processes eight times across four successful crash instances, prompting Alpine to treat the instance as potentially compromised and rebuild it from scratch. No tampering with the aports repository or packages was detected, and all passwords have been reset ahead of the service's reopening.
Background
CVE-2026-97229 is a critical vulnerability in GitLab's CI configuration regex evaluation caused by a flaw in Ruby's bundled Onigmo regex engine. Alpine Linux maintains a self-hosted GitLab instance used for package development and contributor management.
- Source
- Lobsters
- Published
- Oct 29, 2026 at 07:01 AM
- Score
- 8.0 / 10