The vulnerability lies in insufficient validation of the quantity parameter within GraphQL queries in GitLab Enterprise Edition. An authenticated attacker can exploit this flaw by submitting a malformed quantity value that causes the GitLab application to consume excessive resources or hang, leading to a denial of service for all users. The weakness is classified as improper input validation (CWE‑1284).

GitLab EE instances running any version from 18.2 up to, but not including, 18.8.9; 18.9 up to, but not including, 18.9.5; and 18.10 up to, but not including, 18.10.3 are affected. These versions were released before the 2026‑04‑08 patch release that includes the fix.

The CVSS base score of 6.5 indicates a medium severity issue. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires that the attacker be authenticated within the GitLab system, and they must be able to send arbitrary GraphQL queries. Once conditions are met, exploitation can flood the GitLab backend or exhaust its processing resources, potentially bringing the instance to a halt. Because the vector is internal and requires authentication, the likelihood of widespread exploitation is moderate, but any compromised or overly privileged user could trigger the denial of service immediately.