Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open

An attacker tried to exploit CVE-2026-97229, a CVSS 10.0 flaw in GitLab’s Ruby regular-expression engine, on the Alpine Linux project’s own GitLab server a week after GitLab released a fix. Alpine discovered the probe on 20 October, saw worker crashes, 502 errors and failed CI jobs, and rebuilt the server from scratch on 28 October, resetting every account password and replacing secret keys. The upgrade to GitLab 19.3.6 on 22 October did not resolve the flaw because Alpine’s image used standard Ruby; the fix requires Ruby 3.3.13, 3.4.12, 4.0.9 or later, or pulling the updated alpinelinux/gitlab image. Alpine notes that for anyone running GitLab on their own Ruby—whether built from source or in a custom container—upgrading GitLab alone is not enough. ¹