Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux’s development infrastructure between October 20 and 21. The attacks caused repeated crashes in the GitLab process, and although investigators found no evidence that code was executed or that Alpine software was modified, missing logs and outbound connection records meant the project could not rule out a successful breach. Alpine responded by rebuilding its GitLab servers and resetting all passwords.
Attack targeted an unpatched GitLab vulnerability
The attacks targeted CVE-2026-97229, a maximum-severity integer overflow vulnerability in Onigmo, the regular-expression compiler used by GitLab’s CI/CD system and bundled with Ruby. The flaw could allow an unauthenticated attacker to execute arbitrary code on a GitLab server.
GitLab disclosed the vulnerability and released a fix on October 12. Under certain conditions, an attacker could trigger it by submitting a specially crafted regular expression in a CI/CD pipeline configuration.
Alpine initially installed GitLab 19.3.4 rather than the patched 19.3.5 release. A later upgrade to version 19.3.6 did not fix the issue because the required change was in Ruby. Although GitLab included the Ruby patch in its official package, it was missing from Alpine’s custom container image.
Between October 20 and 21, attackers submitted malicious CI configurations targeting the flaw. The activity caused eight worker crashes. Four attempts were partially successful, but none appeared to achieve complete execution.
Alpine rebuilt its GitLab infrastructure
“Since we cannot rule out code execution and the necessary evidence to confirm it no longer exists, we took the harder route and rebuilt our GitLab instance from scratch,” the Alpine Linux team explained.
Alpine Linux is a small, lightweight operating system widely used as the foundation for Docker container images that run applications and services. Its GitLab instance hosts development repositories, code reviews and CI jobs containing the “aports” build recipes used to create Alpine software packages.
Because the environment is involved in building software, tampering with it could have created a supply-chain risk for downstream users. During its investigation, Alpine found that the attackers had downloaded GitLab container images, suggesting they may have been preparing a supply-chain attack.
Alpine found no evidence of tampering with repository commits, packages or releases through October 27. The project’s signing key is not stored on the GitLab server, making it unlikely that the key was exposed.
Source: Alpine Linux
Users advised to reset passwords
A successful exploit could potentially have exposed user details, password hashes, two-factor authentication secrets, CI/CD secrets, integration credentials and private project content. Alpine said it has not seen evidence that any of these were compromised.
However, because relevant logs and outbound connection records were unavailable, the project could not conclusively determine whether code execution occurred. Alpine advises users to reset their GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image published on October 27. The image includes Ruby 3.3.13 and addresses CVE-2026-97229.
Source: www.bleepingcomputer.com
