Alpine upgraded GitLab and stayed vulnerable, because the fix lived in a Ruby patch
The CVSS 10.0 flaw sat in Ruby's regex engine, and GitLab applies its fix only in its own packages. Alpine's image used standard Ruby.
Upgrading to GitLab 19.3.6 on October 22 did not fix CVE-2026-97229 on Alpine's GitLab, an attacker crashed workers eight times on October 21, and the team rebuilt from scratch and reset every password.
Alpine found no evidence the exploit succeeded but says logging gaps mean it cannot rule it out.
A fix that shipped outside the application
Alpine's incident report describes CVE-2026-97229, a CVSS 10.0 flaw in how GitLab evaluates regexes in CI configuration. The bug is in Onigmo, Ruby's regex engine, and GitLab's fix is a set of Ruby patches applied only in its own packages. Alpine moved to 19.3.4 instead of 19.3.5 on October 13, and 19.3.6 on October 22 did not help because its image used standard Ruby.
On October 21 the attacker crashed GitLab workers eight times, got partway through the exploit in four, and downloaded the container image. Alpine found no tampering with releases or packages, signing keys were never on the server, but missing logs mean a successful exploit could have gone unnoticed. The instance was rebuilt, all passwords reset and secret keys replaced. Upstream Ruby shipped the fix in 3.3.13, 3.4.12 and 4.0.9 on October 23.
The thread: patching the component, not the app
"Best I can tell 3 of the four affect old versions of ruby that are not getting a security patch for this. Update your ruby!" — a founder of a Ruby-on-Rails upgrade service
Anyone self-hosting GitLab needs the Ruby fix, not only a GitLab upgrade, and the image should be re-pulled if it was fetched before October 27.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
This is the last story in the October 29, 2026 issue.
Go to the issue archive