GitLab Patched, Server Still Vulnerable: CVE-2026-97229 Lives in Ruby

CVE-2026-97229, a CVSS 10.0 unauthenticated RCE in GitLab CE/EE, stems from an integer overflow in Ruby's Onigmo regex engine, not GitLab's own code. Upgrading GitLab alone leaves self-managed instances exposed unless the bundled Ruby is patched to 3.3.13, 3.4.12 or 4.0.9. CISA added the flaw to its KEV catalog on October 29.

• Alpine upgraded to GitLab 19.3.6 but stayed vulnerable due to unpatched Ruby
• Upstream Ruby fix shipped October 23 in 3.3.13, 3.4.12 and 4.0.9
• CISA added CVE-2026-97229 to KEV with a November 1 patch deadline
• Alpine rebuilt its instance from scratch despite finding no breach evidence