Alpine Linux rebuilds GitLab after eight crashes in attempted RCE attack
Alpine Linux rebuilt its GitLab server and reset passwords after an attacker targeted CVE-2026-97229, a critical flaw in Ruby’s regular-expression engine, on 20 and 21 October. Alpine found no evidence of successful code execution or tampering with packages and releases, but missing logs meant it could not rule out a compromise.
Bottom line — Alpine verified packages built from 20–24 October and says signing keys were not stored on the affected server.
Go deeper 6
-
Alpine recorded eight worker crashes; in four cases, the attacker made partial progress before the exploit failed, according to the project.
-
The attacker downloaded Alpine’s GitLab container image, which Alpine said suggested they were adapting the exploit to its specific build.
-
Alpine’s upgrade to GitLab 19.3.6 did not fix the flaw: its custom image used standard Ruby and lacked the patch included in GitLab’s official packages.
-
The updated Alpine GitLab image published on 27 October includes Ruby 3.3.13. Alpine says users must pull that image again; earlier 19.3.6 images remain vulnerable.
-
Alpine checked aports commits against an independent developer copy and records from all 45 builders; it found no tampering in the examined commits, packages or releases.
-
If exploitation had succeeded, GitLab could have exposed user details, password hashes, two-factor authentication secrets, CI/CD credentials and private project content; none is confirmed stolen.