30 OCT 2026 — The US Cybersecurity and Infrastructure Security Agency (CISA) added a critical GitLab flaw, CVE-2026-97229, to its Known Exploited Vulnerabilities (KEV) list on 29 October. The bug lets an unauthenticated user run code on a GitLab server by slipping a specially built regular expression into the CI/CD settings it processes. The fault lies in Onigmo, Ruby's built-in regular expression engine.
Alpine Linux, which runs its own GitLab, published a post-mortem on 28 October showing that upgrading GitLab did not close the hole on its server. GitLab's fix ships as a patch to the Ruby inside GitLab's own packages, so an installation running GitLab on a standard Ruby also needed a Ruby update. For the Ruby 3.3 and 3.4 series that GitLab's patches targeted, it arrived 11 days after GitLab's.
CISA's listing and its deadline
The KEV entry gives a date added of 2026-10-29 and a due date of 2026-11-01. Its note warns that "Other products can potentially be affected by the same underlying Ruby/Onigmo Integer Overflow issue". CISA marks use in ransomware campaigns as "Unknown", and the entry does not say who exploited the flaw.
The due date binds a narrow group. It flows from Binding Operational Directive 26-04, which CISA describes as "a compulsory direction to federal, executive branch, departments, and agencies". Everyone else gets no deadline, only the knowledge that the flaw has been used in attacks.
Where GitLab put the fix
GitLab fixed CVE-2026-97229 on 12 October in versions 19.2.8, 19.3.5 and 19.4.2. Its release notes give the impacted versions as "all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2" and score the flaw 10.0 using CVSS 3.1, the version our CVSS calculator works with.
The catch is in the page's bug-fix list. Entries that add Ruby regular expression patches "for 3.3 and 3.4" each link to a merge request in one of two GitLab build projects, omnibus-gitlab and CNG. Alpine describes the result as "a set of patches to the Ruby that GitLab bundles in its own packages and container images". Neither the 19.4.2 notes nor the 19.5.1 notes mention installations that run GitLab on a Ruby of their own.
What happened at Alpine
According to Alpine's post-mortem, an account registered on 20 October began submitting malicious CI configurations to its GitLab instance, with the main attack on 21 October. The server was still on 19.3.4: on 13 October Alpine had moved to that release "instead of 19.3.5 (which had the fix) by mistake". The attempts crashed GitLab worker processes eight times. "In 4 of those crashes the attacker got partway through the exploit and failed at the next step," Alpine wrote. The attacker also downloaded Alpine's GitLab container image.
Alpine upgraded to 19.3.6 on 22 October. It made no difference. The project's image ran on standard Ruby and never received the patch. It found the server still vulnerable on 26 October, closed GitLab to everyone except developers and build servers on 27 October, and completed a rebuild on 28 October after resetting every password and swapping out GitLab's secret keys.
Alpine says it has "found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch." It also states, "No signing keys were exposed." Its checks found that the 21 October stable releases, and every package built from 20 to 24 October, came from commits verified against records outside GitLab, and it is extending those checks to 27 October.
Ruby's fix carries no Ruby CVE
Ruby 3.3.13 and 3.4.12 shipped on 23 October alongside 4.0.9. Its advisory says the bug behind CVE-2026-97229 was first fixed in 4.0.8, 3.4.12 and 3.3.13, and that "Ruby 4.0.9, 3.4.12 and 3.3.13 contain all of these fixes" for the four GitLab CVEs it covers.
"We have not requested CVE identifiers in Ruby for these fixes, at least for now," the advisory says, and it asks users to track the bugs under GitLab's numbers, "for example in a security scanner". On our reading, a scanner that judges Ruby by its version number has no Ruby CVE to match, and an unpatched Ruby under a self-built GitLab can pass.
Four regex bugs, two top scores
The Ruby advisory links four GitLab CVEs to these bugs. GitLab's pages score two of them at CVSS 10.0, both reachable by an unauthenticated user: CVE-2026-97229, and CVE-2026-110264, fixed on 21 October, which the 19.5.1 notes say affects "all versions from 7.0 before 18.11.13" as well as later branches. The other two, CVE-2026-89078 and CVE-2026-93577, were fixed on 23 September in 19.4.1, scored 9.9 each and needed an authenticated user.
What to check
- GitLab's own packages or images. For CVE-2026-97229 you need 19.2.8, 19.3.5 or 19.4.2, or later. For CVE-2026-110264 you need the 21 October patch for your branch, which GitLab issued for every branch from 18.11 to 19.5.
- GitLab on your own Ruby. If you built from source or your own container image, as Alpine did, upgrading GitLab "is not enough", in Alpine's words. Your Ruby must also be at least 3.3.13 on the 3.3 series, 3.4.12 on 3.4 or 4.0.9 on 4.0.
- Alpine's image and package. Alpine asks users of its alpinelinux/gitlab image to re-pull the 19.3.6 tag. Only the copy it put out on 27 October carries Ruby 3.3.13, and any earlier pull of that tag is vulnerable. Alpine's own ruby package is fixed at 3.3.13 on Alpine 3.21 and at 3.4.12 on 3.22 to 3.24 and edge; apk upgrade picks it up.
- No timeout workaround. Ruby says "Regexp.timeout does not protect against these bugs", and capping pattern length does not reliably help either, because some bugs fire on short patterns. If you cannot upgrade, do not compile regular expressions from untrusted input in any Ruby application.
- US federal agencies. The KEV due date is 1 November 2026.
The listing will push most administrators to check their GitLab version. Alpine's experience says to check the Ruby underneath it too.
View author profile → · Editorial policy
