GitLab Vulnerability CVE-2026-97229: CISA Confirms Attacks on the CVSS 10 CI/CD Regex Flaw, Why Alpine's Upgrade Missed It, and the Versions to Install

A critical GitLab flaw, CVE-2026-97229, lets a specially crafted regular expression in a CI/CD configuration run code on a self-managed GitLab server, and GitLab scores it 10.0, the maximum. CISA added it to its list of exploited vulnerabilities on October 29, 2026. The Alpine Linux project has also published a detailed account of an attacker trying it against Alpine's own GitLab server, including why one upgrade did not close the hole.

If your company hosts its own GitLab for source code, CI/CD pipelines or deployments, check it this week. GitLab says GitLab.com is already patched and GitLab Dedicated tenants were patched before the release went out.

What is CVE-2026-97229?

GitLab disclosed the flaw on Monday, October 12, 2026, alongside patch releases 19.4.2, 19.3.5 and 19.2.8. GitLab's title is "Integer Overflow issue in CI/CD Regular Expression Compiler impacts GitLab CE/EE." GitLab's advisory says that, under certain conditions, an unauthenticated user could execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. The score is CVSS 10.0, and the researcher joaxcar reported it through GitLab's HackerOne program.

The bug itself is in the regular expression engine built into Ruby, the language GitLab runs on. Ruby's maintainers published fixes on October 23, 2026, and say the bug only matters for programs that build regular expressions from text an attacker controls. GitLab does that when it processes CI/CD configuration. Ruby also notes that its Regexp.timeout setting does not protect against this bug.

Is the GitLab vulnerability being exploited?

Confirmed: CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on Thursday, October 29, 2026, and gave federal agencies until Sunday, November 1 to act. The listing does not say who is attacking or how many servers have been hit.

Confirmed: Alpine Linux's incident report, published Wednesday, October 28, describes an attack attempt. On October 13, Alpine upgraded its server to 19.3.4 instead of 19.3.5, which Alpine calls a mistake, so the fix was missing. On October 20 and 21, a newly registered account sent crafted CI configurations that crashed GitLab worker processes eight times, causing 502 errors and failed CI jobs. Alpine blocked the account on October 23, closed GitLab to everyone except developers and build servers on October 27, rebuilt it, and reopened on 19.3.7 on October 29.

Not known: whether the attacker got in. Alpine writes: "We have found no evidence that it succeeded, but we cannot rule it out." It also warns: "A successful exploit would leave no crash and no trace in the web logs." Some logs from the attack day are missing, so Alpine treated the server as compromised. Alpine says its package and release signing keys were never stored on the GitLab server, and it checked recent package changes against records kept outside GitLab.

Public research: Rapid7 reports it reproduced code execution on the official, unpatched GitLab 19.4.1 image, running a command as GitLab's git user, while the patched 19.4.2 image was not exploitable with the same input. Rapid7 published a technical analysis on October 16, and its alert page links to a Rapid7 proof-of-concept repository on GitHub. In Rapid7's testing, the attacker first needed to commit a malicious .gitlab-ci.yml to a branch of a public project. Rapid7 notes that a server allowing open sign-up removes that hurdle.

Why upgrading GitLab did not fix Alpine's server

On October 22, Alpine upgraded to 19.3.6 and was still vulnerable. The reason: GitLab's fix is a patch to Ruby, and GitLab ships it only in its official Linux packages and official container images. Alpine runs its own GitLab image with a standard Ruby, so the GitLab version number changed but the vulnerable code did not.

GitLab's October 21 release notes say this plainly: if your installation uses its own Ruby instead of the one bundled in GitLab's official packages, upgrading GitLab is not enough. You also need Ruby 3.3.13, 3.4.12, 4.0.9 or later. This is the same trap we described in Updated Is Not the Same as Patched.

A second CVSS 10 GitLab flaw: CVE-2026-110264

On Tuesday, October 21, GitLab released 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 to fix CVE-2026-110264, another integer overflow in the regular expression compiler, also rated 10.0. This one reaches much further back: GitLab lists every version from 7.0 as affected. If you patch for one of these flaws, patch for both.

GitLab fixed versions for CVE-2026-97229

The newest releases also fix CVE-2026-111943, which removes trust in compromised eMudhra certificates. See our eMudhra certificate post for that story.

What to do this week

1. Find every GitLab server, including test and old ones, and note the version shown in the Admin area.
2. Check how each was installed. Official Linux package or official gitlab/gitlab-ce or gitlab/gitlab-ee image: upgrading GitLab carries the Ruby fix. Self-compiled, community image or your own Ruby: also run ruby -v and confirm 3.3.13, 3.4.12, 4.0.9 or later.
3. Upgrade to the newest release in your branch from the table.
4. Until patched, close the doors Rapid7 tested: turn off open sign-up, restrict anonymous access to public projects and stop untrusted users from creating or writing to public projects. Rapid7 says this blocks only its route and does not fix the bug.
5. Take GitLab off the open internet if staff and build servers are the only users, as Alpine did. Put it behind a VPN or an IP allowlist.
6. Look for signs. GitLab published six detection rules, including ones for regex engine worker crashes and CI lint worker crashes. Unexplained 502 errors, failed CI jobs and new accounts sending CI configurations deserve a look. A clean log is not proof.
7. If the server was exposed and unpatched after October 12, assume the worst: rotate runner tokens, CI/CD variables, personal access tokens, webhook and integration credentials, and any cloud keys stored in pipelines.

Why a GitLab flaw matters for a company network

A self-hosted GitLab is rarely just a code store. Its CI/CD variables often hold cloud keys, database passwords and deploy credentials, and its pipelines push code to your live website or app. Alpine's list of what could have been exposed shows the scale: user emails and IP addresses, password hashes, 2FA secrets, CI/CD variables, runner tokens, integration credentials and private repositories.

Alpine was able to vouch for its packages because its signing keys never lived on GitLab. That is a design choice worth copying. If one server falls, it should not hand over the keys to everything you ship. For help deciding who owns these updates, read Who Is Patching the Software That Runs Your Business? and why urgent fixes stall. For running servers like this safely, see our self-hosting infrastructure page.

GitLab vulnerability questions people are asking

Is GitLab.com affected by CVE-2026-97229?

No action is needed. GitLab says GitLab.com runs the patched version and Dedicated tenants were patched in advance.

Is CVE-2026-97229 being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on October 29, 2026.

I upgraded GitLab. Am I safe?

If you use GitLab's official packages or images and reached a fixed version, yes for this flaw. If you run your own Ruby, check the Ruby version too.

Is GitLab 19.3.4 safe?

No. GitLab first named 19.3.4 as fixed, then corrected it. 19.3.5 fixes this flaw, and 19.3.6 or later fixes both regex flaws.

Does an attacker need a GitLab login?

GitLab's score says no. Rapid7's tested route needed the ability to push to a public project, which open sign-up makes easy.

Was Alpine Linux hacked?

Not known. Alpine found no evidence of success, cannot rule it out, rebuilt the server and reset passwords.

The bigger lesson

The version number on the dashboard is not the whole story. Alpine did what most teams do, upgraded GitLab, and stayed exposed because the real fix lived one layer down in Ruby. Know how each server was built, know what it depends on, and keep your most valuable keys somewhere a single compromised server cannot reach.

Want someone to check your GitLab and the servers around it? See security hardening or request a tech quote.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: GitLab patch release 19.4.2; GitLab patch release 19.5.1; GitLab patch release 19.5.3; Alpine Linux incident report; CISA Known Exploited Vulnerabilities catalog; Ruby regexp fixes; Rapid7 alert; Rapid7 technical analysis.