# GitLab's CVSS 10 regex bug is now exploited in the wild. Upgrading GitLab may not be enough — check your Ruby

> CISA has added CVE-2026-97229 to its exploited-vulnerabilities list after an attack on Alpine Linux's GitLab server. The flaw lives in Ruby's regex engine, so self-built and custom GitLab images can stay vulnerable even on a "fixed" version number.

Published Nov 2, 2026 by TechMeasured Staff · Security · Canonical: https://techmeasured.com/security/gitlab-onigmo-regex-rce-exploited-patch-ruby

A maximum-severity GitLab flaw, **CVE-2026-97229**, is now officially being exploited. CISA added it to its Known Exploited Vulnerabilities catalog on October 29 and gave federal agencies until November 1 to fix it, according to The Hacker News. The trigger was an attack on the GitLab server run by the Alpine Linux project — an attack Alpine says "came close to working."

Why it matters beyond GitLab: the bug isn't really in GitLab's code. It sits in **Onigmo, the regular-expression engine built into Ruby**. GitLab's patches fixed the Ruby that ships inside its own packages. If you build GitLab yourself, or run an image that uses the operating system's Ruby, the GitLab version number can say "patched" while the server is still exploitable. That is exactly what happened to Alpine.

## The bugs, in one table

GitLab has shipped fixes for a run of Onigmo-related bugs since September; its release pages credit both CVSS 10 bugs to the researcher joaxcar via HackerOne. Security firm Corgea groups four of them together:

| CVE | CVSS | Disclosed | Entry point | Status |
|---|---|---|---|---|
| CVE-2026-89078 | 9.9 | Sept 23 | Regex compilation | Fixed |
| CVE-2026-93577 | 9.9 | Sept 23 | Regex compilation | Fixed |
| CVE-2026-97229 | 10.0 | Oct 12 | Crafted regex in a CI/CD configuration | **Exploited; in CISA KEV** |
| CVE-2026-110264 | 10.0 | Oct 21 | Specially crafted regex; affects every version back to 7.0 | Fixed out of band |

GitLab describes both CVSS 10 bugs as integer overflows that let an **unauthenticated** user run code on the server. Rapid7 has said exploiting CVE-2026-97229 needs write access to a public project unless the server allows open sign-up and project creation, according to The Hacker News — a bar many self-hosted instances clear easily.

## What happened at Alpine

The Hacker News, summarizing Alpine's incident post, lays out a timeline that is a useful warning:

- **Oct 13:** Alpine upgraded to 19.3.4 rather than the fixed 19.3.5 — a mistake, it says. Rapid7 published a proof-of-concept the same day.
- **Oct 20–21:** A newly registered account submitted crafted CI configurations. GitLab workers crashed eight times; in four of them the attacker got partway through the exploit. The attacker also downloaded Alpine's GitLab container image.
- **Oct 22:** Alpine moved to 19.3.6 — but the server's own Ruby was still vulnerable, so that didn't fix it.
- **Oct 25–26:** Further attempts were blocked; Alpine then found the server still exposed.
- **Oct 27–28:** Alpine locked GitLab down, rebuilt it from scratch on Ruby 3.3.13, replaced GitLab's secret keys and reset passwords.

Alpine found no evidence the attack succeeded but could not rule it out, partly because some logs were missing and outbound connections weren't recorded. It says package-signing keys were never on the GitLab server, and that packages built during the window checked out against records kept outside GitLab.

## What to do now

**1. Upgrade GitLab to the October 21 releases, not the October 12 ones.** The fixed versions for CVE-2026-110264 are **19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13**. GitLab says instances on 18.10 or older have no direct fix and must step up through required upgrade stops. The release includes database migrations, so single-node servers will see downtime. GitLab.com is already patched.

**2. Check the Ruby your GitLab actually runs.** For source installs and custom or distro-built images, upgrade Ruby to **3.3.13, 3.4.12 or 4.0.9** or later. Corgea notes Ruby 4.0.8 lacks the CVE-2026-110264 fix and Ruby 3.2 and older get no patch at all. A quick check:

```bash
# Omnibus/official packages bundle their own Ruby:
/opt/gitlab/embedded/bin/ruby -v
# Source installs and custom images use whatever is on PATH:
sudo -u git -H ruby -v
```

Alpine users can run `apk upgrade` (Alpine 3.21 through edge are fixed) and re-pull `alpinelinux/gitlab:19.3.6`, per The Hacker News.

**3. Hunt for signs of an attempt.** GitLab has published detection rules for self-managed instances, including one for an "Onigmo native worker crash." Repeated Puma or Sidekiq worker crashes, 502 bursts, odd CI configs from new accounts, files owned by the `git` user in `/tmp`, and changed crontabs or SSH keys for `git` are all worth checking.

**4. If you were exposed, assume the worst.** Alpine listed what an attacker could have reached: password hashes, 2FA secrets, CI/CD variables, runner tokens, webhook credentials, personal access tokens and private repos. Rotating those is the safe response.

**5. Lock down sign-ups.** If your instance allows open registration and project creation, turning that off raises the bar for this class of attack.

## Not just a GitLab problem

Corgea points out that any Ruby app that turns attacker-supplied text into a regex (via `Regexp.new` or string interpolation) is exposed to the same engine bugs, and that regex timeouts don't help. Because Ruby hasn't requested separate CVEs, scanners keyed to "gitlab" may miss vulnerable Ruby runtimes in other images. Upgrading Ruby everywhere is the durable fix.


## Sources

1. [GitLab — Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)
2. [GitLab — Critical Patch Release: 19.4.2, 19.3.4, 19.2.8](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-2-released/)
3. [The Hacker News — CISA adds actively exploited GitLab RCE and Cisco firewall DoS flaws to KEV](https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html)
4. [The Hacker News — Attacker tried to exploit Alpine Linux's GitLab server](https://thehackernews.com/2026/10/attacker-tried-to-exploit-alpine-linuxs.html)
5. [Corgea — Ruby Onigmo regexp bugs behind four GitLab RCE CVEs](https://corgea.com/research/cve-2026-110264-97229-93577-89078-ruby-onigmo-regexp-gitlab-rce)