An update to Alpine’s GitLab attack post. The critical GitLab bug Alpine got hit with, CVE-2026-97229, is now officially exploited in the wild.
What’s new
- CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on Thursday and told federal agencies to patch by Sunday.
- It’s an integer overflow in the CI/CD Regular Expression Compiler. An unauthenticated attacker can run code on the server with a crafted regex in a pipeline config.
- Fixed in GitLab CE/EE 19.4.2, 19.3.5 and 19.2.8 or later. GitLab has also shipped threat detections for self-managed instances.
- Shadowserver sees about 2,800 GitLab CE instances exposed online.
Don’t mix this up with CVE-2026-110264, the other max-severity regex bug I covered earlier. Patch for both.
My take
If you self-host GitLab, do it today, and remember Alpine’s lesson: if you run GitLab on your own Ruby, upgrading GitLab alone may not close the hole. Then check runners, tokens and logs for anything you don’t recognize.
God Bless, and Needs Garlic!
