GitLab CVE-2026-97229 (CVSS 10.0) RCE exploited against Alpine Linux and added to CISA KEV; Ruby patch gap left some instances exposed
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 6 fontes trouxeram em 31/10/2026 00:04; os links antigos trazem para cá.
Fontes: bleepingcomputer.com ×2 ↗ securityaffairs.com ↗ gbhackers.com ↗ securityweek.com ↗ thehackernews.com ×2 ↗ cisa.gov ↗
CISA added CVE-2026-97229 (CVSS 10.0), an unauthenticated remote code execution flaw in GitLab CE/EE, to its Known Exploited Vulnerabilities (KEV) catalog on 29 October 2026 (cisa.gov). The listing followed an incident disclosed by Alpine Linux on 28 October. An attacker used crafted CI/CD configurations against gitlab.alpinelinux.org on 20-21 October, crashing GitLab workers and getting partway through the exploit (thehackernews.com, securityweek.com). Alpine found no evidence of success but could not rule it out, so it rebuilt the server from scratch, rotated GitLab secret keys and reset all passwords. Its package-signing and release keys were never on that server. The flaw lives in the Onigmo regex engine in Ruby, so upgrading GitLab alone did not fix instances running standard Ruby (thehackernews.com, securityweek.com). The KEV remediation deadline for FCEB agencies is 1 November 2026. GitLab has detected exploitation attempts itself, and Shadowserver tracks nearly 2,800 internet-exposed GitLab CE instances (bleepingcomputer.com). CISA's alert gives no attribution, victim or campaign-scale details, and ransomware use is listed as unknown (cisa.gov, gbhackers.com).
Entenda a falha
A vulnerabilidade
CVE-2026-97229 (CVSS 10.0, CWE-190, integer overflow or wraparound) is in GitLab CE/EE, in the regular expression compiler that handles CI/CD configurations. The bug is in Onigmo, the regex engine built into Ruby. GitLab says an unauthenticated user could run code on the server through a crafted regular expression, with no user interaction. Rapid7's tested route needs write access first, unless users can self-register and create projects. Affected: GitLab 19.2 before 19.2.8, 19.3 before 19.3.5, 19.4 before 19.4.2. Self-compiled installs and custom images on standard Ruby also need Ruby 3.3.13, 3.4.12, 4.0.9 or later; Ruby 3.2 gets no fix. CVE-2026-76418 (CVSS 8.6) is an unchecked return value causing a NULL pointer dereference in Cisco Secure Firewall ASA and FTD. A remote unauthenticated attacker can force a reload (DoS). The articles give no Cisco versions. Both are in CISA KEV, due 1 November.
Como funciona
In GitLab, a CI configuration such as a .gitlab-ci.yml reaches the CI/CD regular expression compiler, which GitLab runs through Ruby's Onigmo engine to parse, compile and evaluate regexes. With a crafted expression, the validation is insufficient and an integer overflow or wraparound happens, which can end in code execution as GitLab's git user. The published description does not give the internal sequence. At Alpine, crafted configurations crashed GitLab workers 8 times, with 502 errors and failed CI jobs. In 4 crashes the exploit got partway and failed at the next step. For Cisco ASA/FTD, the articles only say an unchecked return value leads to a NULL pointer dereference and an unexpected reload.
Por que é vulnerável
GitLab attributes the flaw to insufficient regular expression validation, classified as an integer overflow or wraparound: an arithmetic result exceeds what its representation supports, which can break security checks or memory operations. The bug sits in Onigmo inside Ruby, not in GitLab's own code. GitLab's 12 October fix patched the Ruby shipped in its Linux packages and container images, and Ruby released its own fixed versions on 22 and 23 October. A GitLab upgrade does not change a server's own Ruby, so installs on standard Ruby stayed vulnerable. As of 29 October, GitLab's patch posts did not tell self-compiled admins to update Ruby. In Cisco, the code skips checking a return value and then dereferences NULL. The articles do not say why either flaw went unnoticed.
Onde está
The Onigmo regular expression engine in Ruby, used by GitLab's CI/CD Regular Expression Compiler, which processes pipeline configurations; no article names a file, function or commit, and none names the Cisco component.
Como foi descoberta
Researcher joaxcar reported CVE-2026-97229 through GitLab's HackerOne bug bounty program. GitLab published its advisory on 12 October and the CVE record followed on 13 October. GitLab says it detected exploitation attempts and released threat detections for self-managed customers. Alpine Linux disclosed on 28 October that a newly registered account probed its unpatched GitLab 19.3.4 server on 20-21 October and downloaded its container image. Alpine blocked the account on 23 October, and attempts on 25-26 October failed. Alpine found no evidence of success but could not rule it out, so it rebuilt the server. CISA added the flaw to KEV on 29 October. Cisco said earlier in October it knew of exploitation of CVE-2026-76418 and did not name attackers or victims; the articles do not say who found it.
PoC pública
Rapid7 built a working exploit in a lab and published proof-of-concept code on 13 October. It ran commands as GitLab's git user on an unpatched official GitLab 19.4.1 image, but the same input did not work on the patched 19.4.2 image. It needs write access first: a malicious .gitlab-ci.yml and a UTF-8 file path committed to a branch of a public project. That step is not needed where users can self-register and create projects. Rapid7 does not know how the original private report avoids the write step. Since a working PoC is public and exploitation is confirmed, patch GitLab and Ruby urgently. The articles give no link to the code.
Explicação gerada por IA a partir da matéria e dos artigos, em 31/10/2026 00:19.
Detalhes técnicos
- Flaw: integer overflow or wraparound (CWE-190) in the CI/CD regular expression compiler, caused by insufficient regex validation in Onigmo. A crafted regular expression in a CI/CD configuration gives unauthenticated code execution (gbhackers.com, bleepingcomputer.com, securityweek.com). CVSS v3.1: network, low complexity, no privileges, no user interaction, high impact on confidentiality, integrity and availability (gbhackers.com).
- Affected versions: GitLab 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 (gbhackers.com). Researcher joaxcar reported it via GitLab's HackerOne program (gbhackers.com, bleepingcomputer.com).
- Dates: GitLab advisory 12 October (securityweek.com). CVE record published 13 October (gbhackers.com). Rapid7 published a working proof of concept on 13 October. Its route needs write access first: a malicious .gitlab-ci.yml and a UTF-8 file path committed to a public project branch. That requirement does not apply where users can self-register and create projects. Alpine has not said how its attacker's configurations reached GitLab (thehackernews.com).
- Alpine exposure: Alpine upgraded to GitLab 19.3.4 on 13 October instead of 19.3.5, which it calls a mistake. A newly registered account began probing on 20 October. Crafted configurations on 20-21 October crashed workers 8 times, with 502 errors and failed CI jobs, and in 4 crashes the attacker got partway through the exploit. The attacker also downloaded Alpine's GitLab container image, suggesting the exploit was being tuned to that build. Maintainers said the attack "came close to working" (thehackernews.com, securityweek.com).
- Response: Alpine blocked the account on 23 October, and attempts on 25-26 October failed. On 26 October it found the server still vulnerable after the 19.3.6 upgrade of 22 October, and it restricted access on 27 October. The rebuild finished on 28 October with Ruby 3.3.13 or later (thehackernews.com).
- Forensics: no unexpected files, keys, hooks or processes, no timing delays, and no private data seen leaving via web or API requests. Some logs from the attack day are missing and no outbound connections were logged, so code execution cannot be excluded. If the exploit had succeeded, exposed data could include user names, emails, IPs, 2FA secrets, CI/CD variables, runner tokens, webhook, integration and push-mirror credentials, hashed personal access tokens, and private repositories, issues and merge requests. Alpine has not said whether runner tokens, CI/CD variables, access tokens or integration credentials were replaced (thehackernews.com).
- Integrity: every aports change from 20-22 October came through a recorded push by a known developer, checked against a developer's copy and all 45 build servers. Packages built 20-24 October were checked against records outside GitLab. The aports repository, packages and 21 October releases were not tampered with (thehackernews.com, securityweek.com).
- Credential stuffing: Alpine also saw automated logins using passwords leaked from other sites (thehackernews.com, securityweek.com).
- Context: the flaw is one of several GitLab issues in 2026: CVE-2026-0723 (2FA bypass), CVE-2026-110264 (a separate max-severity regex compiler RCE), and CVE-2026-85706 (commits API data leak, added to KEV after watchTowr reported mass scanning). CISA has flagged six GitLab vulnerabilities as exploited since November 2021, including CVE-2021-22175 and CVE-2021-39935 (bleepingcomputer.com).
- Companion KEV entry: CVE-2026-76418 (CVSS 8.6, thehackernews.com), an unchecked return value causing a NULL pointer dereference in Cisco Secure Firewall ASA and FTD. An unauthenticated remote attacker can force a reload (DoS). Cisco acknowledged in-the-wild exploitation earlier in October, and has not identified the attackers, the number of targets or post-access activity (cisa.gov, thehackernews.com).
Remediação
- Upgrade GitLab CE/EE to 19.2.8, 19.3.5 or 19.4.2 or later (gbhackers.com, bleepingcomputer.com). If you run your own Ruby (source builds or custom container images), also move to Ruby 3.3.13, 3.4.12, 4.0.9 or later, because the GitLab package upgrade alone did not fix those instances (securityweek.com, thehackernews.com).
- Apply GitLab's published threat detections on self-managed instances (bleepingcomputer.com).
- Treat unpatched, internet-exposed GitLab as potentially compromised. Hunt for crashed worker processes, 502 errors and anomalous CI configurations from newly registered accounts. Consider rotating secret keys, tokens and CI/CD variables, and reset passwords given the credential-stuffing activity (thehackernews.com, securityweek.com).
- Under BOD 26-04, FCEB agencies must prioritize KEV items on exposed assets, perform forensic triage to check for pre-patch compromise, and follow vendor mitigations or stop using the product. Patch Cisco ASA/FTD as well. CISA urges all organizations to prioritize KEV remediation (cisa.gov, gbhackers.com).
Relatos divergentes
- KEV status: thehackernews.com reported on 28 October that the CVE was not yet in KEV. CISA (cisa.gov) added it on 29 October, which supersedes that.
- Deadline wording: securityweek.com describes a three-day deadline. gbhackers.com and thehackernews.com give 1 November 2026, a Sunday per bleepingcomputer.com. These are consistent.
- Alpine blocking date: the earlier thehackernews.com article says the account was blocked on 23 October with failed attempts on 25-26 October. A later thehackernews.com piece says attempts were blocked on 25-26 October. The earlier, more detailed account is likely more precise.
- Fixed version: gbhackers.com and bleepingcomputer.com list 19.3.5 as fixed, while thehackernews.com reports that 19.3.6 still left Alpine's standard-Ruby image vulnerable. The Ruby-level fix explains this.
Linha do tempo
-
CISA confirms in-the-wild exploitation of max-severity GitLab RCE CVE-2026-97229
BleepingComputer adds that GitLab released threat detections for self-managed customers after detecting exploitation attempts itself, that Shadowserver tracks nearly 2,800 internet-exposed GitLab CE instances, and places the flaw in a 2026 series of GitLab issues (CVE-2026-0723 2FA bypass, CVE-2026-110264 regex compiler RCE, CVE-2026-85706 commits API data leak added to KEV after watchTowr reported mass scanning). It also notes CISA has tagged six GitLab vulnerabilities as exploited since November 2021, including CVE-2021-22175 and CVE-2021-39935.
ler a análise desta fonte ocultar
BleepingComputer adds that GitLab released threat detections for self-managed customers after detecting exploitation attempts itself, that Shadowserver tracks nearly 2,800 internet-exposed GitLab CE instances, and places the flaw in a 2026 series of GitLab issues (CVE-2026-0723 2FA bypass, CVE-2026-110264 regex compiler RCE, CVE-2026-85706 commits API data leak added to KEV after watchTowr reported mass scanning). It also notes CISA has tagged six GitLab vulnerabilities as exploited since November 2021, including CVE-2021-22175 and CVE-2021-39935.
CISA added CVE-2026-97229, a maximum-severity remote code execution flaw in GitLab CE/EE, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The bug is an integer overflow in the CI/CD Regular Expression Compiler that lets unauthenticated remote attackers execute arbitrary code via a crafted regular expression in a CI/CD configuration. GitLab patched it in versions 19.4.2, 19.3.5 and 19.2.8 and released threat detections for self-managed customers after observing exploitation attempts. Shadowserver tracks nearly 2,800 internet-exposed GitLab Community Edition instances. Federal agencies were ordered under BOD 26-04 to remediate by Sunday, and CISA urged private-sector teams to patch immediately.
Technical Details
- CVE-2026-97229: integer overflow in the CI/CD regex compiler, insufficient expression validation, unauthenticated RCE on the GitLab server.
- Reported by researcher joaxcar.
- Part of a run of GitLab issues in 2026: CVE-2026-0723 (2FA bypass), CVE-2026-110264 (max-severity regex compiler RCE), and CVE-2026-85706 (repository commits API data exposure), the latter added to KEV after watchTowr observed internet-wide scanning.
- CISA has flagged six GitLab vulnerabilities as exploited since November 2021, including CVE-2021-22175 and CVE-2021-39935.
Remediation
- Upgrade to GitLab CE/EE 19.4.2, 19.3.5 or 19.2.8.
- Apply GitLab's published threat detections on self-managed instances.
- FCEB agencies must comply with BOD 26-04 deadlines; all organizations should prioritize patching.
-
CISA confirms active exploitation of GitLab CVE-2026-97229 (CVSS 10.0) unauthenticated RCE
This article adds the vulnerability's precise affected and fixed version ranges (19.2.8, 19.3.5, 19.4.2), the CWE-190 classification, the CVE publication date of 13 October 2026, and credit to researcher joaxcar via GitLab's HackerOne program. It also notes the KEV entry explicitly requires forensic triage under BOD 26-04 and lists ransomware involvement as unknown.
ler a análise desta fonte ocultar
This article adds the vulnerability's precise affected and fixed version ranges (19.2.8, 19.3.5, 19.4.2), the CWE-190 classification, the CVE publication date of 13 October 2026, and credit to researcher joaxcar via GitLab's HackerOne program. It also notes the KEV entry explicitly requires forensic triage under BOD 26-04 and lists ransomware involvement as unknown.
CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on 29 October 2026, confirming active exploitation of a CVSS 10.0 flaw in GitLab Community Edition and Enterprise Edition. The bug allows unauthenticated attackers to execute arbitrary code on a GitLab server via a specially crafted regular expression in a CI/CD configuration, stemming from insufficient regex validation and classified as an integer overflow/wraparound weakness (CWE-190). The CVE record was published on 13 October 2026 and credits researcher joaxcar, who reported it through GitLab's HackerOne bug bounty program. The KEV entry sets a 1 November 2026 remediation deadline and marks forensic triage as required under BOD 26-04; ransomware involvement is listed as unknown. Public sources do not identify attackers, victims or campaign scale.
Technical Details
- CVSS v3.1 vector: network attack vector, low complexity, no privileges, no user interaction, high impact to confidentiality, integrity and availability.
- Affected: GitLab 19.2 < 19.2.8, 19.3 < 19.3.5, 19.4 < 19.4.2.
Remediation
- Upgrade to 19.2.8, 19.3.5 or 19.4.2.
- Apply vendor-directed mitigations, perform forensic triage per BOD 26-04, assess internet exposure of each asset, follow cloud-service guidance, or discontinue use where mitigations are unavailable.
-
CISA adds GitLab CVE-2026-97229 to KEV after failed exploit attempt on Alpine Linux instance
SecurityWeek adds that CISA has now added CVE-2026-97229 to its KEV catalog (contradicting the earlier 28 October status that it was not listed), with a three-day remediation deadline for federal agencies under BOD 26-04. It also confirms GitLab's advisory date of 12 October and Alpine's statement that the aports repository, packages and the 21 October releases were not tampered with.
ler a análise desta fonte ocultar
SecurityWeek adds that CISA has now added CVE-2026-97229 to its KEV catalog (contradicting the earlier 28 October status that it was not listed), with a three-day remediation deadline for federal agencies under BOD 26-04. It also confirms GitLab's advisory date of 12 October and Alpine's statement that the aports repository, packages and the 21 October releases were not tampered with.
SecurityWeek reports that CVE-2026-97229 (CVSS 10.0), a maximum-severity GitLab code execution flaw rooted in insufficient regular expression validation in Onigmo, Ruby's regex engine, was exploited roughly one week after GitLab's October 12 advisory. Alpine Linux says a threat actor attacked its GitLab instance on 20-21 October using a newly registered account to submit crafted CI/CD configurations that crashed worker processes; in 4 crashes the attacker got partway through the exploit and also pulled Alpine's GitLab container image, suggesting the exploit was being tuned to that exact build. The attack failed, but Alpine rebuilt the instance from scratch, verified that the aports repository, packages and the 21 October releases were untampered, and reset all passwords after seeing automated logins with credentials from other leaks. Because the bug lies in Ruby rather than GitLab, upgrading to GitLab 19.3.6 alone did not remediate instances running their own Ruby. On Thursday, CISA added the CVE to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch within three days under BOD 26-04.
Technical Details
- Unauthenticated arbitrary code execution on the GitLab server via a specially crafted regular expression in a CI/CD configuration.
- Root cause: insufficient regex validation in Onigmo, used by Ruby.
- Attacker used a newly registered account; worker process crashes observed; GitLab container image downloaded for exploit tuning.
Remediation
- Upgrade GitLab to the latest patched release; if running your own Ruby (from source or custom container image), also upgrade to Ruby 3.3.13, 3.4.12, 4.0.9 or later.
- Federal agencies must comply with the 3-day KEV deadline under BOD 26-04.
- Reset and avoid reused passwords given observed credential-stuffing attempts.
-
CISA KEV: GitLab CVE-2026-97229 RCE exploited against Alpine Linux, Cisco ASA/FTD DoS CVE-2026-76418
The Hacker News adds exploitation specifics absent from the CISA alert: CVSS scores (10.0 for GitLab, 8.6 for Cisco), the technical nature of the GitLab RCE (crafted regex in CI/CD configuration), Cisco's earlier acknowledgement of in-the-wild exploitation of the ASA/FTD DoS flaw, and the Alpine Linux incident of 20-21 October 2026 where an attacker crashed GitLab workers eight times, downloaded the GitLab container image, and was blocked on 25-26 October; Alpine rebuilt the instance from scratch. Remediation deadline for FCEB agencies is 1 November 2026.
ler a análise desta fonte ocultar
The Hacker News adds exploitation specifics absent from the CISA alert: CVSS scores (10.0 for GitLab, 8.6 for Cisco), the technical nature of the GitLab RCE (crafted regex in CI/CD configuration), Cisco's earlier acknowledgement of in-the-wild exploitation of the ASA/FTD DoS flaw, and the Alpine Linux incident of 20-21 October 2026 where an attacker crashed GitLab workers eight times, downloaded the GitLab container image, and was blocked on 25-26 October; Alpine rebuilt the instance from scratch. Remediation deadline for FCEB agencies is 1 November 2026.
CISA added CVE-2026-97229 (CVSS 10.0) and CVE-2026-76418 (CVSS 8.6) to its Known Exploited Vulnerabilities catalog, citing active exploitation. The GitLab flaw is an integer overflow in GitLab CE/EE that lets an unauthenticated user execute arbitrary code via a crafted regular expression in a CI/CD configuration. The Cisco flaw is an unchecked return value leading to a NULL pointer dereference in Cisco Secure Firewall ASA and FTD, allowing an unauthenticated remote attacker to force an unexpected reload (DoS); Cisco acknowledged in-the-wild exploitation earlier in October. The GitLab listing stems from an incident disclosed by Alpine Linux, whose unpatched GitLab instance was probed on 20-21 October 2026 with crafted CI configurations that crashed worker processes eight times. FCEB agencies must remediate by 1 November 2026.
Technical Details
The attacker's exploit against Alpine Linux failed at the next step in four of the eight crashes, and also downloaded Alpine's GitLab container image. Further attempts on 25-26 October were blocked. Maintainers said the attack "came close to working" and, unable to rule out success, treated the instance as compromised and rebuilt it from scratch; checks showed the aports repository, packages and the 21 October releases were not tampered with. Cisco has not identified the attackers, the number of targeted organizations, or post-access activity.
Remediation
- Patch GitLab CE/EE and Cisco ASA/FTD immediately; FCEB deadline is 1 November 2026.
- Treat unpatched, internet-exposed GitLab instances as potentially compromised and hunt for crashed worker processes and anomalous CI configurations.
-
CISA adds actively exploited GitLab CVE-2026-97229 and Cisco ASA/FTD CVE-2026-76418 to KEV Catalog
ler a análise desta fonte ocultar
CISA added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 29 October 2026, based on evidence of active exploitation. The first is CVE-2026-97229, an integer overflow or wraparound flaw in GitLab Community Edition and Enterprise Edition. The second is CVE-2026-76418, an unchecked return value leading to a NULL pointer dereference in Cisco Secure Firewall ASA Software and Cisco Secure FTD Software. CISA notes these vulnerability classes are frequent attack vectors and pose significant risk to the federal enterprise. No exploitation details, attribution or victim information are provided in the alert.
Remediation
- BOD 26-04 requires FCEB agencies to prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets that grant total control post-exploitation, and to check whether threat actors compromised the system before the patch was applied.
- CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog remediation.
-
Attacker probes Alpine Linux's GitLab with CVE-2026-97229 (CVSS 10.0) exploit after GitLab's patch left standard Ruby vulnerable
ler a análise desta fonte ocultar
Alpine Linux disclosed on 28 October that an attacker tried to exploit CVE-2026-97229 (CVSS 10.0), a GitLab remote code execution flaw rooted in the Onigmo regex engine in Ruby, against its own server gitlab.alpinelinux.org. Alpine found no evidence the exploit worked but cannot rule it out. It treated the server as compromised, rebuilt it from scratch, rotated GitLab's secret keys and reset all account passwords. The server stayed exposed because Alpine's GitLab image used standard Ruby: GitLab's fix is a patch to the Ruby bundled in its own packages and images, so upgrading to GitLab 19.3.6 on 22 October did not close the hole. Alpine says the keys that sign its packages and releases were never on the GitLab server, and that packages built from 20 to 24 October were checked against records outside GitLab.
Technical Details
- On 13 October Alpine upgraded to GitLab 19.3.4 instead of 19.3.5, which it calls a mistake. A newly registered account began probing the server on 20 October.
- Crafted CI configurations sent on 20 and 21 October crashed GitLab worker processes 8 times and caused 502 errors and failed CI jobs. In 4 crashes the attacker got partway through the exploit. The attacker also downloaded Alpine's GitLab container image, which Alpine says suggests the exploit was being tuned to its exact build.
- Alpine blocked the account on 23 October. Further attempts on 25 and 26 October failed. On 26 October Alpine found the server was still vulnerable after the 19.3.6 upgrade, closed it to everyone except developers and build servers on 27 October, and finished the rebuild on 28 October with Ruby 3.3.13 or later.
- No timing delays, unexpected files, keys, hooks or processes were found, and no private data was seen leaving via web or API requests. Some logs from the attack day are gone, and no outbound network connections were logged, so code execution cannot be excluded.
- If the exploit succeeded, exposed data could include user names, email and IP addresses, 2FA secrets, CI/CD variables, runner tokens, webhook, integration and push mirror credentials, hashed personal access tokens, and private repositories, issues and merge requests. Alpine has not said whether runner tokens, CI/CD variables, access tokens or integration credentials have been replaced.
- Package integrity check: every aports change added from 20 to 22 October arrived via a recorded push by a known developer, verified against a developer's repository copy and all 45 build servers.
- Rapid7 published a working proof of concept on 13 October. Its route needs write access first: a malicious .gitlab-ci.yml and a UTF-8 file path committed to a public project branch. That requirement does not apply where users can self-register and create projects. Alpine has not said how its attacker's CI configurations reached GitLab.
- Alpine also saw automated login attempts using passwords leaked from other sites.
- As of 28 October, CVE-2026-97229 was not in CISA's KEV catalog.
- Ruby's maintainers say the bug matters only for programs that compile a regex from attacker-controlled text, and that Regexp.timeout does not protect against it.
Remediation
- For GitLab Linux packages or official images, upgrade to the newest release for the branch (21 October releases, which also fix CVE-2026-110264). For self-compiled installs or images with their own Ruby, upgrade GitLab and Ruby to 3.3.13, 3.4.12, 4.0.9 or later. Ruby 3.2 gets no fix. Servers on 19.3.4 should move to 19.3.6.
- Pull alpinelinux/gitlab:19.3.6 again: only the image published on 27 October contains Ruby 3.3.13. Run apk upgrade for Alpine's Ruby packages (3.4.12 on Alpine 3.22 to edge, 3.3.13 on 3.21).
- Interim measures from Rapid7: restrict anonymous access to public projects, stop untrusted users from creating or writing to public projects, or block the CI lint route. These cover only Rapid7's route.
- Deploy GitLab's six Sigma detection rules (four experimental). Hunt for files owned by the git user in /tmp, unexpected child processes of Puma or Sidekiq, outbound connections, and changed crontabs or SSH keys. On signs of code execution, rotate secrets in gitlab-secrets.json, all CI/CD variables, runner tokens and access tokens.
- Alpine account holders must reset their password when the server reopens and change any reused password elsewhere.