GitLab security incident: attempted exploitation of CVE-2026-97229
24 points by durrendal
24 points by durrendal
Upgrading to GitLab 19.3.6 on October 22 didn’t fix the vulnerability. The fix isn’t in GitLab’s own code but in a patch to Ruby, which GitLab applies only in its official packages. Our image used standard Ruby, so it didn’t get the patch.
I guess this is a risk of repackaging things that I hadn't really considered prior...the vagueness of the CVE releases didn't really help, either (I get why they do that, but still, it wasn't clear where the problem actually was).
It's exacerbated further by the fact that the patches to ruby didn't land until two days after Gitlab announced the CVE.
But yes, if we had been using Gitlab's official images then we'd have gotten the fix regardless of where it was in the stack. It isn't Gitlab's or Ruby's fault though, just really unfortunate timing rather.