https://reddit.com/r/sysadmin/comments/1xjyfns/gitlab_cve202697229_cvss_100_went_into_cisa_kev/: GitLab CVE-2026-97229 (CVSS 10.0) went into CISA KEV on Oct 29, due Nov 1. If your GitLab runs on a system Ruby, the GitLab upgrade alone does not fix it

Q: Which GitLab deployment types need a Ruby update in addition to the GitLab update?

Installations that use a system Ruby, including Alpine Linux deployments, source installs, and distribution packages, need Ruby updated separately. The GitLab fix updates the Ruby bundled with Omnibus and CNG packages, but does not update a system Ruby.

Q: What Ruby versions contain the fix for system-Ruby deployments?

Update to Ruby 3.3.13 or 3.4.12, or to Ruby 4.0.8 or a later release in the 4.0 series. The referenced Ruby releases were issued on October 23.

Q: Are GitLab.com and GitLab Dedicated customers affected?

GitLab.com and GitLab Dedicated were already patched. The affected products identified are self-managed CE/EE instances in the listed version ranges.

Q: Is exploitation known to be practical?

Yes. Rapid7 published a working proof of concept on October 13, and CISA added the issue to its Known Exploited Vulnerabilities catalog on October 29.

Q: What evidence shows that upgrading GitLab alone may be insufficient?

Alpine Linux reported attacks on October 20–21 after it had upgraded GitLab. Its GitLab deployment used a system Ruby, leaving the vulnerable regex engine present until Ruby itself was updated.

Published Oct 31, 2026

Updated

Affected Software

2 affected components

GitLab GitLab CE/EE>=19.2.0<=19.2.7, >=19.3.0<=19.3.4, >=19.4.0<=19.4.1

Ruby Ruby<3.3.13, <3.4.12, <4.0.8

Frequently Asked Questions

Which GitLab deployment types need a Ruby update in addition to the GitLab update?

Installations that use a system Ruby, including Alpine Linux deployments, source installs, and distribution packages, need Ruby updated separately. The GitLab fix updates the Ruby bundled with Omnibus and CNG packages, but does not update a system Ruby.

What Ruby versions contain the fix for system-Ruby deployments?

Update to Ruby 3.3.13 or 3.4.12, or to Ruby 4.0.8 or a later release in the 4.0 series. The referenced Ruby releases were issued on October 23.

Are GitLab.com and GitLab Dedicated customers affected?

GitLab.com and GitLab Dedicated were already patched. The affected products identified are self-managed CE/EE instances in the listed version ranges.

Is exploitation known to be practical?

Yes. Rapid7 published a working proof of concept on October 13, and CISA added the issue to its Known Exploited Vulnerabilities catalog on October 29.

What evidence shows that upgrading GitLab alone may be insufficient?

Alpine Linux reported attacks on October 20–21 after it had upgraded GitLab. Its GitLab deployment used a system Ruby, leaving the vulnerable regex engine present until Ruby itself was updated.

https://reddit.com/r/sysadmin/comments/1xjyfns/gitlab_cve202697229_cvss_100_went_into_cisa_kev/: GitLab CVE-2026-97229 (CVSS 10.0) went into CISA KEV on Oct 29, due Nov 1. If your GitLab runs on a system Ruby, the GitLab upgrade alone does not fix it

Affected Software

Frequently Asked Questions

Which GitLab deployment types need a Ruby update in addition to the GitLab update?

What Ruby versions contain the fix for system-Ruby deployments?

Are GitLab.com and GitLab Dedicated customers affected?

Is exploitation known to be practical?

What evidence shows that upgrading GitLab alone may be insufficient?

Company

Resources

Contact

Frequently Asked Questions

Which GitLab deployment types need a Ruby update in addition to the GitLab update?

What Ruby versions contain the fix for system-Ruby deployments?

Are GitLab.com and GitLab Dedicated customers affected?

Is exploitation known to be practical?

What evidence shows that upgrading GitLab alone may be insufficient?