GitLab Updated but Still Vulnerable? The Alpine Incident and Ruby Checks

The GitLab upgrade finished and the version number looks right. Has the vulnerability actually gone away? Alpine Linux's incident is a useful reminder that the answer depends on how GitLab was installed. Updating the application can leave the Ruby runtime underneath it unchanged.

There are two things to identify: the GitLab release and the Ruby interpreter that runs it. Ruby is the language runtime GitLab depends on. Running an arbitrary ruby -v command in your shell does not establish which interpreter the service uses.

What happened at Alpine?

According to Alpine's incident report, an attacker attempted to exploit CVE-2026-97229 on October 20 and 21. Alpine subsequently upgraded GitLab to 19.3.6, but its custom image did not include the Ruby patches shipped in GitLab's official packages. The application version changed while the underlying problem remained.

Alpine found no evidence that attacker-supplied code executed, but could not rule it out and rebuilt the instance. Its checks found no tampering in packages or release files. An October 30 update says GitLab has reopened. This is an attempted-exploitation incident, not evidence that Alpine's distribution packages were compromised.

Which versions does the advisory cover?

CVE-2026-97229 concerns regular expressions in CI/CD configuration, the instructions used for automated build, test and deployment work. A regular expression is a pattern used to match text. In this case, processing a crafted pattern can corrupt memory and, under certain conditions, allow remote code execution.

These are the initial fixes for this CVE in GitLab's October 12 announcement, not a list of the newest releases to install today. The October 21 security release addressed additional issues, including CVE-2026-110264. Reaching one number in the table does not settle your exposure to every subsequent advisory.

Identify the interpreter inside the installation

For an official Linux package installation, gather the environment information and inspect its embedded Ruby. These are inspection commands, not vulnerability scans:

sudo gitlab-rake gitlab:env:info
/opt/gitlab/embedded/bin/ruby -v

The second path belongs to the official Linux package layout. It may not exist in a source installation or a different image. On a multi-node deployment, run the environment task on a GitLab Rails node rather than assuming the database node has the same tools. See the maintenance task documentation for that distinction.

With Docker, replace the sample container name gitlab below. The first command reports its image reference and running image ID. The second reads the environment inside a container using the official package layout:

docker inspect --format '{{.Config.Image}} {{.Image}}' gitlab
docker exec gitlab gitlab-rake gitlab:env:info

A custom image may start Ruby from a different path. Inspect that actual interpreter. Pulling a rebuilt image under the same tag also does not replace an already running container: compare the running image ID with the image you intend to deploy.

Apply the fix through the right installation path

For official packages or images, follow GitLab's supported upgrade procedure. Check required upgrade stops and database migrations before crossing a large release gap. Have a restorable backup and a maintenance plan before changing the installation.

If GitLab uses your own Ruby build, upgrading GitLab alone is insufficient. Ruby's combined advisory lists 3.3.13, 3.4.12 and 4.0.9 as containing all four related fixes. Choose a patched release in a branch your GitLab installation supports; do not jump to Ruby 4.0 without checking compatibility. The underlying CVE-2026-97229 fix entered the 4.0 branch in 4.0.8, whereas 4.0.9 is the common fix level for all four issues. A distribution may backport patches without adopting the upstream version number, so check its package revision and advisory together.

After deployment, confirm that the services restarted with the intended interpreter and that normal jobs run. Installing a patch does not remove an earlier compromise. Unexpected worker crashes or suspicious CI activity warrant a separate incident investigation using preserved records and GitLab's detection guidance. Keep the running Ruby version and package or image identity alongside the GitLab version in the final verification record.