TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Alpine Linux says an attacker tried to exploit CVE-2026-97229 against its GitLab instance on October 20 and 21, causing eight worker crashes. The project found no evidence of code execution or tampering with repositories and releases, but said missing logs prevent it from ruling out a breach; it rebuilt GitLab and reset all passwords.
Alpine Linux said on October 28 that it had rebuilt its GitLab instance after an attacker attempted to exploit CVE-2026-97229 on October 20 and 21. The project found no evidence the exploit succeeded or that its software releases were altered, but said gaps in its logs meant it could not rule out code execution; all GitLab passwords were reset.
According to Alpine’s incident report, a newly registered account submitted crafted CI configurations to a GitLab instance running version 19.3.4, which lacked the vulnerability fix. The attempts crashed GitLab worker processes eight times. In four crashes, Alpine said, the attacker advanced partway through the exploit but failed at the next step. The attacker also downloaded Alpine’s GitLab container image, which the project said suggested efforts to adapt the exploit to its specific build.
Alpine said the vulnerability involves GitLab’s evaluation of regular expressions in CI configuration and originates in Onigmo, the regular-expression engine included with Ruby. GitLab published fixed releases on October 12. However, the fix was delivered through patches to the Ruby version bundled in GitLab’s official packages and container images. Alpine said its own image used standard Ruby and did not receive that patch. Ruby released versions containing the fix on October 23: 3.3.13, 3.4.12 and 4.0.9.
The project initially upgraded to GitLab 19.3.6 on October 22, but later found the instance remained vulnerable. Alpine’s timeline says it identified the problem on October 26, closed GitLab to everyone except developers and build servers on October 27, and completed a fresh rebuild the following day. It also replaced GitLab’s secret keys. Alpine says users will need to reset their passwords through the sign-in page when the service reopens; the instance was still being tested before public access resumed.
Why the Ruby Patch Matters
The incident highlights that a GitLab version upgrade may not address a vulnerability when the relevant fix is applied in a bundled dependency rather than GitLab’s own application code. Alpine said operators using their own Ruby installation, including in source builds or custom container images, must update Ruby as well as GitLab. Its report advises users of the Alpine GitLab image to pull the 19.3.6 image published October 27; earlier copies of that tag and older tags remain vulnerable, according to the project.
For Alpine users, the project’s assessment is that its package supply chain shows no sign of compromise. Alpine said it checked repository commits against records outside GitLab, including a developer’s clone and its 45 build servers. It reported that the October 21 stable releases and packages built from October 20 to 24 matched verified commits. These checks matter because a compromised development server could potentially threaten software distributed to users, but Alpine says it found no evidence that happened.
The password reset is a precaution for GitLab account holders. Alpine also warned people who reused their GitLab password on other services to change it there, citing automated login attempts against its GitLab using passwords leaked from other sites. That warning is separate from evidence of access to Alpine accounts: the report does not say those attempts succeeded.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
EcoFlow Smart Home Panel 2 Whole-Home Backup System Hub
Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels
As an affiliate, we earn on qualifying purchases.
How the Incident Unfolded
Alpine’s timeline says the vulnerability was published on October 13, the day after GitLab’s October 12 release of a fix. Alpine mistakenly upgraded to GitLab 19.3.4 rather than 19.3.5, which it said contained the fix. The attacker began probing on October 20, and the main wave of attempts followed on October 21, when Alpine observed crashes, 502 errors and failed CI jobs.
After upgrading to 19.3.6 on October 22, Alpine blocked the attacker’s account on October 23. It says attempts to return on October 25 and 26 failed, but the instance was still found to be vulnerable on October 26. The project then shut public access and began rebuilding. The vulnerability is rated CVSS 10.0 in Alpine’s report, which describes it as critical.
Alpine said its package-signing keys are not stored on the GitLab server. It also reported that the October 21 stable releases—3.21.9, 3.22.7, 3.23.7 and 3.24.3—and packages built over the following days were checked against external records. While GitLab is unavailable, Alpine said its package mirrors, cgit service, mailing lists and IRC remain available.
What the Missing Logs Leave Open
Alpine said it found no evidence that attacker code ran: its timing checks showed no delays, and it found no unexpected files, keys, hooks or processes. It also said it found no private data returned through web or API requests it could inspect. But those findings do not establish that execution was impossible. The project said some background-job logs and the old container’s filesystem were no longer available, and it had no records of outbound network connections; its hosting provider kept none either.
Alpine warned that, if the exploit had succeeded, information potentially exposed could have included user names, email addresses and IP addresses; password hashes and two-factor authentication secrets; CI/CD variables and runner tokens; integration credentials; personal access tokens stored as hashes; and private repositories or confidential issues and merge requests. The report does not say that any of these were accessed. It also does not identify the attacker or specify whether the attempts targeted Alpine alone.
The available source material does not provide a reopening date for GitLab or a full accounting of what happened during each crash. Alpine says evidence needed to confirm or rule out code execution no longer exists, leaving the outcome uncertain despite the checks it conducted.
Reopening and Account Recovery
Alpine said it was testing the rebuilt GitLab instance before restoring public access and would publish instructions when it reopens. Users should expect to set new passwords through the service’s “Forgot your password?” link. The project asked anyone who reused their GitLab password elsewhere to change it on those other services and directed questions to infra@alpinelinux.org.
For administrators using GitLab with a separately supplied Ruby runtime, Alpine’s guidance is to install a Ruby version that includes the fix—3.3.13, 3.4.12, 4.0.9 or later—rather than relying only on a GitLab upgrade. Users of Alpine’s container image should pull the version published October 27, which Alpine says includes Ruby 3.3.13. The project has not announced a timeline for public reopening in the report.
Key Questions
Did the attacker successfully exploit Alpine’s GitLab server?
Alpine said it found no evidence of successful code execution, but could not rule it out because some relevant logs and the old container’s filesystem were unavailable.
Were Alpine Linux packages or releases altered?
Alpine reported that it found no sign of tampering in its aports repository, packages, or October 21 releases. It said it compared commits and build outputs with records held outside GitLab.
Why did upgrading GitLab to 19.3.6 not fix the issue?
Alpine said the fix was a patch to GitLab’s bundled Ruby, not a change in GitLab’s own code. Its container image used standard Ruby, so the upgrade alone did not include the needed fix.
What should Alpine GitLab users do about passwords?
All passwords were reset. When GitLab reopens, Alpine says users will need to choose new passwords using the “Forgot your password?” link. Anyone who reused that password elsewhere should change it on those services too.
Is Alpine’s GitLab service open again?
Alpine said the rebuild was complete on October 28, but the instance was still being tested before public reopening. The report did not give a reopening date.
Source: hn
