Alpine Linux Rebuilds GitLab After Attempted RCE Attack

Alpine Linux rebuilds GitLab after attempted RCE attack. Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20–21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.

The attacks targeted CVE-2026-97229, a maximum-severity remote code execution flaw, repeatedly crashing GitLab processes, with some attempts coming close to succeeding. Although Alpine Linux found no evidence that attackers executed code or tampered with its software packages and releases, it could not rule out a successful compromise due to missing logs and a lack of outbound connection records.

CVE-2026-97229 is a maximum-severity integer overflow vulnerability in GitLab's CI/CD regular expression compiler Onigmo, bundled in Ruby, that could allow unauthenticated attackers to execute arbitrary code on the server. GitLab disclosed the flaw and made fixes available on October 12, warning that attackers can trigger it under certain conditions by submitting a specially crafted regular expression in a CI/CD pipeline configuration.

On October 20-21, the attacker submitted malicious CI configurations targeting the flaw, causing eight worker crashes; four were partially successful, though none seemed to go all the way. The Alpine Linux team found that the attackers downloaded its GitLab container image, suggesting they may have been preparing a supply-chain attack.

After investigating, Alpine found no tampering in the repository commits, packages, or releases up to October 27. Alpine advises users to reset their GitLab passwords and pull the alpinelinux/gitlab:19.3.6 image published on October 27, which contains Ruby 3.3.13 and addresses CVE-2026-97229.