CISA KEV catalog addition October 29, 2026; Alpine Linux post-mortem October 28, 2026
A 10.0 GitLab Flaw Is in the KEV Catalog, and Updating GitLab Alone Did Not Fix It at Alpine Linux
CISA added CVE-2026-97229, a GitLab flaw scored 10.0 under CVSS 3.1, to its Known Exploited Vulnerabilities catalog on October 29 and set a remediation due date of November 1, 2026 for federal civilian agencies. The flaw is an integer overflow in Onigmo, the regular expression engine built into Ruby, reached through regular expressions in CI/CD configuration files: under certain conditions a specially crafted expression lets an unauthenticated attacker run code on the GitLab server. GitLab fixed it on October 12 in versions 19.2.8, 19.3.5, and 19.4.2, and GitLab.com and GitLab Dedicated were already patched. The catch is where the fix lives. GitLab shipped it as a patch to the Ruby bundled inside its own Linux packages and official container images, so installations that run GitLab on a standard Ruby of their own received nothing from a GitLab upgrade. Alpine Linux learned that directly: after mistaking 19.3.4 for the fixed release, its server was probed from October 20, with crafted CI configurations crashing GitLab workers eight times and the attacker getting partway through the exploit in four of those crashes. Alpine upgraded to 19.3.6 on October 22 and remained vulnerable, found the gap on October 26, restricted access on October 27, and rebuilt the instance by October 28 after resetting every password and replacing GitLab secret keys, reporting no evidence of success by the attacker and no exposure of signing keys, while stating it could not rule success out. Upstream Ruby fixes arrived October 22 and 23 in 3.3.13, 3.4.12, and 4.0.9; Ruby 3.2 is end of life and will not receive a fix, and Ruby requested no CVE identifiers of its own for these bugs, so version-based scanners have no Ruby CVE to match. CISA notes that other products can potentially be affected by the same underlying Ruby and Onigmo issue, and marks ransomware campaign use as unknown. A second GitLab flaw scored 10.0, CVE-2026-110264, was fixed in the October 21 releases, so the October 12 builds do not close both.
Executives
The headline version number was not the vulnerable component. Alpine did upgrade, on time and in good faith, and stayed exposed for six more days because the fix lived one layer down in the bundled runtime. The leadership question for any self-hosted platform is simple: when a vendor says patched, patched in which component, and who verified the running system rather than the release notes.
CIO / CISO
Split the work by install type today. GitLab Linux packages and official images need 19.2.8, 19.3.5, or 19.4.2 or later for this flaw, and the October 21 or later builds for CVE-2026-110264. Source-built installs and custom images need both the GitLab upgrade and Ruby at 3.3.13, 3.4.12, or 4.0.9 or later, and any Ruby 3.2 in the path is a finding on its own. Where code execution is suspected, follow GitLab guidance to treat the server as compromised and rotate secrets and tokens, as Alpine did.
Engineers
Check the Ruby under GitLab, not just GitLab: ruby -v on the host or in the image is the decisive test, and re-pull any Alpine gitlab image taken before October 27 even if its tag reads 19.3.6. Ruby states that Regexp.timeout does not protect against these bugs and that capping pattern length does not reliably help. Until patched, reduce exposure by restricting anonymous registration and public project creation where your instance allows it, and hunt for repeated worker crashes and unusual CI lint or CI configuration activity from mid-October onward.
Everyone (non-IT)
If your team hosts its own code platform, expect an urgent update and possibly a password reset this week. A reset after an incident of this kind is the careful move, not a sign that your code was taken, and Alpine reports its package signing keys were never on the affected server.