Body:
A CVSS 10.0 in GitLab’s CI/CD regex compiler — and the October 12 patch isn’t enough.
CVE-2026-97229 is an integer overflow (CWE-190) in Onigmo, Ruby’s regex engine. A crafted pattern in .gitlab-ci.yml triggers an overflow in the compiler’s program-size arithmetic, producing invalid bytecode that executes as the git OS account — the account that owns every repo, CI variable, and deployment key on the instance.
What you need to know:
Rapid7 published a working PoC the day after the patch
Alpine Linux was attacked 8 days later — worker crashed 8 times, attacker downloaded the container image to tune the exploit
CISA added it to KEV (federal deadline: Nov 1)
The Oct 12 releases (19.4.2/19.3.5/19.2.8) don’t cover CVE-2026-110264 — a second regex flaw in the same engine. You need 19.4.3/19.3.6/19.2.9 (Oct 21)
Source and custom-image installs also need Ruby 3.3.13, 3.4.12, or 4.0.9 — GitLab’s version doesn’t proxy the Ruby runtime
Detection hint: repeated Puma worker crashes in a short window are the only reliable artefact of a failed exploit attempt.
Full technical breakdown including the PR:N controversy, Alpine Linux incident timeline, and mitigation checklist:
Top comments (0)