Alpine Linux has rebuilt its GitLab server from scratch after an attacker came close to exploiting a maximum-severity vulnerability in the system that builds every Alpine package. The project disclosed the incident on 28 October, saying it found no evidence the attack succeeded but could not rule it out, so it treated the instance as compromised.

The flaw, tracked as CVE-2026-97229 and rated 10.0, sits in the Onigmo regular-expression engine bundled with Ruby and can be triggered through a crafted regular expression in a GitLab CI configuration, potentially allowing an attacker to run code on the server.

Eight crashes and a near miss

A newly registered account sent crafted CI configurations to gitlab.alpinelinux.org on 20 and 21 October, crashing GitLab workers eight times. In four of those crashes the exploit got partway through before failing at the next step, and the attacker also downloaded Alpine's GitLab container image, which Alpine read as an attempt to tune the exploit to its exact build. The attacker returned on 25 and 26 October without success.

Why the patch did not protect Alpine

GitLab released a fix on 12 October, but the fix is a patch to the Ruby that GitLab bundles in its own packages and images, not a change to GitLab's own code. Alpine's image used standard Ruby, so upgrading to GitLab 19.3.6 on 22 October left the flaw open; upstream Ruby shipped the fix on 23 October in versions 3.3.13, 3.4.12 and 4.0.9, and Alpine republished its image with Ruby 3.3.13 on 27 October. Images pulled before that date remain vulnerable.

Alpine verified that its aports repository and packages built during the incident window were not tampered with, and that its signing keys were never held on the GitLab server. All GitLab passwords have been reset and secret keys replaced.