Ruby patched three Onigmo regex bugs that enabled code execution in GitLab when it compiled attacker-controlled patterns.

Alpine Linux had upgraded to GitLab 19.3.6, but its environment remained vulnerable to CVE-2026-97229. Its container image used standard Ruby, where the vulnerability resided. The incident shows why an application version alone cannot establish that the vulnerable dependency has been fixed. ## What happened CVE-2026-97229 has a CVSS score of 10/10 and stems from insufficient regular expression validation in Onigmo, Ruby’s regular expression engine. GitLab said the flaw could allow unauthenticated users to execute arbitrary code on the server through specially crafted regular expressions in CI/CD configuration. On October 20 and 21, a threat actor targeted Alpine Linux’s GitLab server. According to Alpine Linux, the attacker used newly registered accounts to submit specially crafted CI configuration, causing worker processes to crash. Those crashes were observed; server-side code execution remained uncertain. The attack was reported as unsuccessful. Alpine Linux, however, said it had found no evidence that the attacker executed code on the server while acknowledging that it could not rule out that possibility. Alpine Linux rebuilt the server from scratch. Its checks found no tampering with the aports repository, packages, or releases dated October 21. Those findings apply to the named assets and do not resolve the uncertainty about code execution. ## TMGS recommendations TMGS recommends that organizations operating their own GitLab deployments verify dependencies before closing patch tickets: * Inventory the deployed GitLab and Ruby versions and the container image’s origin. * Confirm that remediation addresses the vulnerable component, then verify the running environment after updating. * Assign responsibility for verification across application and infrastructure teams. * Preserve logs covering new accounts, CI configuration changes, and worker failures when suspicious activity appears. * Check source code and release package integrity when server compromise is suspected. The acceptance criterion should be evidence that the vulnerable component has been addressed in the running system. Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/cap-nhat-gitlab-chua-du-neu-ruby-van-con-loi-i.e37b9fea-7b5b-43c8-8af6-cf78a9127596

Alpine Linux의 GitLab 인스턴스가 10월 20~21일 CVE-2026-97229 악용 공격 을 받음. 성공 증거는 없지만 코드 실행 가능성을 배제할 수 없어 침해된 것으로 간주하고 처음부터 재구축함 취약점은 GitLab 자체 코드가 아니라 Ruby의 정규식 엔진 Onigmo 에 있음. 자체...

BleepingComputer, publié le 1er novembre 2026. L'article rapporte une tentative d'attaque contre l'infrastructure GitLab du projet open-source Alpine Linux, survenue les 20 et 21 octobre 2026. Des attaquants ont ciblé CVE-2026-97229, une vulnérabilité de type integer overflow de sévérité maximale affectant le compilateur d'expressions régulières CI/CD Onigmo, intégré à Ruby et bundlé dans GitLab.

The core maintenance team behind the Ruby programming language has released versions 4.0.9, 3.4.12, and 3.3.13. Specifically, these critical updates resolve severe vulnerabilities within the embedded Onigmo regular expression parsing engine. These underlying memory errors previously exposed GitLab instances to catastrophic remote code execution attacks. In the GitLab security release documentation, researchers revealed that untrusted patterns allowed adversaries to compromise host servers completely.

TL;DR On October 23, 2026, the Ruby team shipped a Ruby security update in versions 4.0.9, 3.4.12 and 3.3.13. The releases fix memory bugs in Onigmo, Ruby's regular expression engine. GitLab had found that these bugs allowed remote code execution on its servers and assigned four CVEs to them. Why It Matters GitLab already patched the Ruby it ships. However, any other Ruby app that compiles user-supplied patterns faces the same risk.

🚨 First PHP, now Ruby... Memory corruption vulnerabilities in Ruby's regex engine (Onigmo) could lead to RCE in applications that compile regular expressions from untrusted user input. Not just ReDo...

'プログラミング言語Rubyのコアメンテナンスチームが、バージョン4.0.9、3.4.12、3.3.13をリリースしました。今回の重要なアップデートでは、組み込みの正規表現解析エンジン「Onigmo」に存在した深刻な脆弱性が修正されています。これらのメモリエラーにより、GitLabのインスタンスは

Alpine Linux says an attacker tried to exploit CVE-2026-97229 against gitlab.alpinelinux.org on October 20 and 21 and came close to succeeding. The flaw is a CVSS 10.0 bug in GitLab CI regex handling in Onigmo and enables remote code execution via a crafted CI file, per SecurityOnline. Exploitation required only a newly registered account and a malicious CI configuration, with no local access, which Alpine confirmed when the account registered October 20 and crashed workers remotely. The attack crashed GitLab workers eight times, with four attempts progressing past the initial regex crash before failing at the next stage, according to Alpine. The attacker downloaded Alpine’s GitLab container image, suggesting exploit tuning to the exact build, Alpine said. Alpine had upgraded to 19.3.4 on October 13 instead of the fixed 19.3.5 released October 12, and its October 22 upgrade to 19.3.6 still left the instance vulnerable. The fix is a Ruby patch applied only in GitLab official packages, so Alpine’s image using standard Ruby stayed vulnerable until it republished 19.3.6 with Ruby 3.3.13 on October 27, Alpine said. With no proof that code execution failed and with background job logs and the old container filesystem gone, Alpine treated the instance as...

Alpine Linux

TL;DR On October 20 and 21, an attacker tried to exploit a critical GitLab vulnerability on Alpine Linux's own GitLab server. The flaw, CVE-2026-97229, scores 10.0 on CVSS and can lead to remote code execution. Alpine says the attack "came close to working," so it rebuilt the whole instance from scratch. The CVE does not yet appear in CISA's KEV catalog.

Alpine Linux says an attacker tried to exploit CVE-2026-97229 against gitlab.alpinelinux.org on October 20 and 21 and came close to succeeding. The flaw is a CVSS 10.0 bug in GitLab CI regex handling in Onigmo and enables remote code execution via a crafted CI file, per SecurityOnline. Exploitation required only a newly registered account and a malicious CI configuration, with no local access, which Alpine confirmed when the account registered October 20 and crashed workers remotely. The attack crashed GitLab workers eight times, with four attempts progressing past the initial regex crash before failing at the next stage, according to Alpine. The attacker downloaded Alpine’s GitLab container image, suggesting exploit tuning to the exact build, Alpine said. Alpine had upgraded to 19.3.4 on October 13 instead of the fixed 19.3.5 released October 12, and its October 22 upgrade to 19.3.6 still left the instance vulnerable. The fix is a Ruby patch applied only in GitLab official packages, so Alpine’s image using standard Ruby stayed vulnerable until it republished 19.3.6 with Ruby 3.3.13 on October 27, Alpine said. With no proof that code execution failed and with background job logs and the old container filesystem gone, Alpine treated the instance as...

Ruby patched three Onigmo regex bugs that enabled code execution in GitLab when it compiled attacker-controlled patterns.

Fixes bugs in the Onigmo regex engine that allowed remote code execution on GitLab servers, covering four CVEs, with patches for Ruby 4.0, 3.4 and 3.3.

TL;DR On October 20 and 21, an attacker tried to exploit a critical GitLab vulnerability on Alpine Linux's own GitLab server. The flaw, CVE-2026-97229, scores 10.0 on CVSS and can lead to remote code execution. Alpine says the attack "came close to working," so it rebuilt the whole instance from scratch. The CVE does not yet appear in CISA's KEV catalog.