Attacker Tried to Exploit Alpine Linux’s Git Lab via CVSS 10.0 Flaw Its Ruby Left Open
Summary: An attacker probed the Alpine Linux project's own GitLab server starting 20 October, sending crafted CI configurations that crashed GitLab worker processes 8 times, a week after GitLab released a fix for CVE-2026-97229, a CVSS 10.0 flaw in Ruby's Onigmo regex engine. Alpine found no evidence the exploit succeeded but rebuilt the server from scratch and reset every account password because a successful exploit would leave no crash and no trace in the web logs.
Key Takeaway: Alpine's 22 October upgrade to GitLab 19.3.6 did not fix the flaw because its image used standard Ruby rather than the Ruby GitLab patches in its own packages, and as of 29 October GitLab's patch release posts still did not tell self-compiled installs to update Ruby.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-97229
- Related
- CISA Adds Two Known Exploited Vulnerabilities to Catalog Cyber Risks · Oct 29, 2026CVE-2026-97229: Git Lab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability Known Exploited Vulnerabilities · Oct 29, 2026