Alpine Linux rebuilds GitLab after attempted remote-code execution attack - Cybersecurity

Alpine Linux rebuilt its GitLab server and reset user passwords after attackers tried to exploit a critical vulnerability in its development infrastructure on October 20 and 21. The project found no evidence of tampering but could not rule out a compromise because key logs were unavailable.

Attackers targeted Alpine Linux’s GitLab instance with CVE-2026-97229, a maximum-severity integer overflow vulnerability in GitLab’s CI/CD regular expression compiler, Onigmo, which is bundled with Ruby. Under certain conditions, the flaw could allow unauthenticated attackers to execute arbitrary code through a specially crafted regular expression in a CI/CD pipeline configuration.

The attacks repeatedly crashed GitLab processes. Alpine reported eight worker crashes, including four that were partially successful, although none appeared to achieve code execution. The attackers also downloaded Alpine’s GitLab container image, an action the project said could indicate preparation for a supply-chain attack.

Alpine initially deployed GitLab 19.3.4 instead of the fixed 19.3.5 release. A subsequent upgrade to 19.3.6 did not resolve the issue because the necessary Ruby patch was included in GitLab’s official packages but missing from Alpine’s custom container image.

The project found no evidence that attackers executed code or modified repository commits, software packages, or releases through October 27. It also said signing keys could not have been exposed because they are not stored on the GitLab server. However, missing logs and the absence of outbound connection records prevented Alpine from definitively excluding a successful compromise.

As a precaution, the Alpine Linux team rebuilt the GitLab instance from scratch and reset all passwords. The server hosts development repositories, code reviews and CI jobs, including the “aports” build recipes used to produce Alpine packages, making it an important part of the project’s software supply chain.

Alpine said a successful exploit could potentially have exposed user information, password hashes, two-factor authentication secrets, CI/CD secrets, integration credentials and private project content, although it confirmed no compromise of those assets. Users were advised to reset their GitLab passwords and use the alpinelinux/gitlab:19.3.6 image published on October 27, which includes Ruby 3.3.13 and addresses CVE-2026-97229.

Sources: BleepingComputer.