GitLab CVE-2026-97229: CISA Lists CVSS 10 CI Flaw as Exploited; Own-Ruby Servers Also Need a Ruby Update

TL;DR: CISA added GitLab™’s CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog on October 29, 2026, with a November 1 due date for US federal agencies. GitLab rates the flaw CVSS 10.0, the maximum: “under certain conditions” it could let an unauthenticated user run code on a GitLab server through a crafted regular expression in a CI/CD configuration. GitLab fixed it on October 12 in 19.4.2, 19.3.5 and 19.2.8. The catch: GitLab’s fix is a patch to the Ruby it ships, so servers that run GitLab on their own Ruby also need Ruby 3.3.13, 3.4.12, 4.0.9 or later. Alpine Linux says an attacker tried to exploit the flaw on its GitLab server, which it then rebuilt.

What happened

The flaw. GitLab describes CVE-2026-97229 as an integer overflow in its CI/CD regular expression compiler. According to GitLab’s October 12 critical patch release:

• Affected versions: GitLab CE/EE from 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2. GitLab notes that 19.3.4 had a separate bug that 19.3.5 fixes; for this CVE, 19.3.4 is in the affected range.
• Score: CVSS 10.0, rated reachable over the network with low complexity, no privileges and no user interaction.
• Who is already covered: GitLab.com runs the patched version, and GitLab Dedicated tenants were patched before the release went out.
• Detection: GitLab has published six threat detections for self-managed instances, including “Onigmo native worker crash” and “ci lint workhorse worker crash.”

It’s on CISA’s exploited list. CISA’s October 29 alert added CVE-2026-97229 “based on evidence of active exploitation.” The KEV catalog entry lists the date added as October 29, 2026, and the due date as November 1, 2026. CISA’s note on the entry says other products “can potentially be affected by the same underlying Ruby/Onigmo” bug.

The Ruby part. Ruby’s maintainers say the underlying bug is in Onigmo, Ruby’s regular expression engine. GitLab patched the Ruby in its own releases, and Ruby shipped the fix upstream in Ruby 4.0.9, 3.4.12 and 3.3.13 on October 23. Ruby lists no fixed 3.2 release; The Hacker News reports that Ruby 3.2 reached end of life in April and will get no fix.

The Alpine attempt. Alpine Linux said on October 28 that a newly registered account sent crafted CI configurations to its GitLab server on October 20 and 21, while it was still on 19.3.4. That crashed GitLab worker processes 8 times, and in 4 of them “the attacker got partway through the exploit and failed at the next step.” Alpine also found that its October 22 upgrade to GitLab 19.3.6 didn’t fix the flaw, because its image used standard Ruby without GitLab’s patch. Alpine found no evidence that the attack succeeded but couldn’t rule it out, so it rebuilt the server, reset all passwords and replaced GitLab’s secret keys. It says its packages and October 21 releases weren’t tampered with and no signing keys were exposed.

This is a different flaw from CVE-2026-110264, the regex bug GitLab fixed on October 21. We covered that one in GitLab’s CVSS 10 patch for CVE-2026-110264.

Why it matters

Small teams often run self-managed GitLab on a single server that holds their code, CI/CD pipelines and deployment secrets. This flaw now has a CISA exploitation listing and a public account of an attempt on a real server. Our read: the Alpine case also shows that the version number in /help can mislead you: a GitLab release with the fix doesn’t protect you if GitLab runs on a Ruby that lacks it.

What to do now

1. Check your version. Sign in as an administrator and open /help on your instance (or the Admin area). If you’re on 19.2, 19.3 or 19.4 below 19.2.8, 19.3.5 or 19.4.2, you’re affected.
2. Take a backup first, so you can roll back if the upgrade fails. GitLab says this patch includes database migrations, so single-node servers will be down while they run.
3. Upgrade. 19.4.2, 19.3.5 and 19.2.8 fix this CVE. GitLab has shipped newer patches since then; its October 29 release (19.5.3, 19.4.5, 19.3.7, 19.2.10 and older branches) is the newest, so moving straight to the newest release on your branch also picks up the later fixes, including CVE-2026-110264.
4. If you run GitLab on your own Ruby, update Ruby too. That means self-compiled installs and container images that install Ruby separately. Alpine’s advice: “upgrading GitLab is not enough: you also need Ruby 3.3.13, 3.4.12, 4.0.9 or later.” GitLab’s own Linux packages and official images carry the patched Ruby.
5. If you can’t upgrade right away, limit exposure. The Hacker News reports that Rapid7 suggests restricting anonymous access to public projects, stopping untrusted users from creating or writing to public projects, or blocking the CI lint route. Rapid7 says these cover only its own exploit route and don’t fix the flaw.
6. Look for signs of attack. Run GitLab’s six detections (listed in its advisory) against your logs. GitLab’s guidance, as reported by The Hacker News, warns that a successful exploit can leave no crash. If anything looks wrong, treat the server as compromised and rotate the secrets in gitlab-secrets.json, CI/CD variables, runner tokens and access tokens.
7. If you use GitLab.com, there’s nothing to patch.

Updates

• Oct 30, 2026, 10:15 a.m. Manila: First published. We’ll add a dated note here if GitLab revises its advisory or more exploitation is reported.

Sources & method

Sources

• GitLab, “GitLab Critical Patch Release: 19.4.2, 19.3.5, 19.2.8,” Oct 12, 2026
• GitLab, “GitLab Patch Release and Security Update: 19.5.3, 19.4.5, 19.3.7, 19.2.10, 19.1.10, 19.0.11, 18.11.14,” Oct 29, 2026
• GitLab patch release RSS feed (release dates)
• CISA, “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” Oct 29, 2026
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-97229 entry)
• Ruby, “Regexp compilation fixes related to GitLab’s CVE-2026-89078, CVE-2026-93577, CVE-2026-97229 and CVE-2026-110264,” Oct 23, 2026
• Alpine Linux, “GitLab security incident: attempted exploitation of CVE-2026-97229,” Oct 28, 2026
• The Hacker News, “Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open,” Oct 29, 2026

Method. Checked October 30, 2026, at 9:30 a.m. Manila time (01:30 UTC); KEV catalog version 2026.10.29. The affected and fixed versions, CVSS score, description, detections, migration note and GitLab.com and Dedicated status come from GitLab’s October 12 release post; the newest releases come from GitLab’s October 29 post and RSS feed. The KEV dates come from CISA’s catalog entry. The Ruby versions come from Ruby’s advisory. The attack details come from Alpine’s own report. The Ruby 3.2 end-of-life note, Rapid7’s stopgaps and GitLab’s post-exploit guidance come from The Hacker News. The steps under “What to do now” are our own judgment, built on those sources. No affiliate links on this page. GITLAB is a trademark of GitLab Inc. in the United States and other countries and regions. How we work.