Alpine Linux Rebuilds GitLab After Attempted RCE Attack

Alpine Linux rebuilt its GitLab server and reset all passwords after attackers tried to exploit a critical vulnerability in its development infrastructure on October 20–21. The project said it found no evidence of code execution or tampering, but missing logs and outbound connection records meant it could not rule out a compromise.

The attacks targeted CVE-2026-97229, a maximum-severity integer overflow flaw in Onigmo, the regular expression compiler used in GitLab CI/CD and bundled with Ruby. Under certain conditions, an unauthenticated attacker could trigger the flaw with a specially crafted regular expression in a pipeline configuration and execute code on the server. GitLab disclosed the vulnerability and released fixes on October 12.

Alpine first installed GitLab 19.3.4 instead of the patched 19.3.5. An upgrade to 19.3.6 also left the vulnerability open because Alpine’s custom container image lacked the Ruby patch included in GitLab’s official packages. On October 20–21, malicious CI configurations caused eight worker crashes; four attempts were partially successful, but none appeared to complete.

The attackers also downloaded Alpine’s GitLab container image, which the project said could indicate preparation for a supply-chain attack. Alpine reported no tampering in repository commits, packages, or releases through October 27. It said signing keys were not at risk because they are not stored on the GitLab server.

Alpine said a successful exploit could have exposed user details, password hashes, 2FA secrets, CI/CD secrets, integration credentials, and private project content; it has not confirmed that any were compromised. The project advised users to reset GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image published on October 27, which includes Ruby 3.3.13 and addresses CVE-2026-97229.