GitLab CVE-2026-97229 Hit Alpine Linux, Now in KEV

CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities (KEV) catalog on Thursday, according to The Hacker News. The flaw is a CVSS 10.0 integer overflow in GitLab CE and EE that lets an unauthenticated user run code on the server through a crafted regular expression in a CI/CD configuration. Federal civilian agencies must apply fixes by November 1, 2026.

If you self-host GitLab and have not upgraded since the October 13 patch release, do it today. Our original coverage lists the fixed versions: 19.4.2, 19.3.5 and 19.2.8.

What happened at Alpine Linux

The KEV listing traces to an incident Alpine Linux disclosed. Per The Hacker News, an unknown actor tried to exploit the flaw against Alpine’s GitLab instance on October 20 and 21, 2026. The instance was unpatched at the time.

• The attacker sent crafted CI configurations, which crashed GitLab worker processes eight times.
• In four of those crashes, the attempt failed at the next step.
• The attacker also downloaded Alpine’s GitLab container image.
• Return attempts on October 25 and 26 were blocked.

Alpine’s maintainers said: “The attack came close to working. We have found no evidence that it succeeded, but we cannot rule it out, so we treated the instance as compromised and rebuilt it from scratch.” Their checks show the aports repository, packages and the October 21 releases were not tampered with.

What to do

1. Patch first. Upgrade to a fixed release. Everything else on this list assumes you have done that.
2. Check your worker logs. Repeated GitLab worker crashes around CI configuration processing were the visible signal at Alpine. If you saw them before patching, treat that as a possible intrusion, not a flaky service.
3. Decide whether to rebuild. Alpine could not rule out compromise and rebuilt from scratch. If your instance was exposed and unpatched during the window and you see crash patterns, that is the bar to measure against.
4. Review container image pulls and access logs. The attacker pulled Alpine’s image, so check for unexpected downloads of yours.

Priority call

This is a same-day patch for any internet-reachable self-managed instance. A KEV listing plus a near-miss at a security-focused distribution is as clear as exploitation evidence gets. The reported activity is limited to one victim and no confirmed success, so do not read it as proof of mass compromise. It is proof that someone is actively testing this bug against real targets.

This is the latest in a run of GitLab regex-driven RCEs. See our coverage of the CVSS 10.0 flaw affecting 12 years of releases and the Ruby regex engine root cause. For other recent listings, see our KEV coverage.