CVE-2026-3848

Improper Neutralization of CRLF Sequences ('CRLF Injection') in GitLab

Published Mar 11, 2026 CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to make unintended internal requests through proxy environments under certain conditions due to improper input validation in import functionality.

Analysis

Technical impact

This vulnerability, identified as CWE‑93, occurs because GitLab’s import functionality does not properly neutralize CRLF sequences. When an authenticated user supplies crafted input, the system can perform unintended internal HTTP requests through configured proxy environments. The result is that the application may reach internal services or endpoints that the user is not authorized to access, potentially exposing sensitive internal data or allowing bypass of access controls.

Affected Systems

Affected products are GitLab Community and Enterprise Editions. All releases from 8.11 up to 18.7.5, from 18.8.0 up to 18.8.5, and from 18.9.0 up to 18.9.1 would be vulnerable. The recommendation is to upgrade to GitLab 18.7.6, 18.8.6, 18.9.2 or later. The CPE string shows the product is GitLab:gitlab.

Risk and Exploitability

The CVSS v3 base score is 5.0, indicating a medium severity. The EPSS score is below 1%, implying a low probability of exploitation in the wild. This vulnerability is not indexed in CISA’s KEV catalog. Attack execution requires an authenticated user with access to the import feature; no publicly available remote exploitation path is documented. Remediation by upgrading mitigates the risk completely.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

GitLab

unaffected

Version	Status	Constraints
`8.11`	affected	< 18.7.6
`18.8`	affected	< 18.8.6
`18.9`	affected	< 18.9.2

Configuration 1 [-]

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

No data.

Vendor Product Versions

Gitlab

Version	Status	Scheme	Platform
`[8.11,18.7.6)`	affected	generic	—
`[18.8,18.8.6)`	affected	generic	—
`[18.9,18.9.2)`	affected	generic	—

Remediation

Vendor Solution

Upgrade to versions 18.7.6, 18.8.6, 18.9.2 or above.

OpenCVE Recommended Actions

Upgrade to GitLab version 18.7.6, 18.8.6, or 18.9.2 and later to resolve the CRLF injection issue.
If immediate upgrade is not possible, restrict or disable the import functionality for all users until the patch is applied.
Verify that proxy settings are correctly configured to avoid unintended internal requests.

Generated by OpenCVE AI on March 17, 2026 at 16:32 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.218% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/
https://gitlab.com/gitlab-org/gitlab/-/work_items/577298

History

Apr 16, 2026 4:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:gitlab:gitlab:::::community:::* cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

Mar 12, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 11, 2026 4:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to make unintended internal requests through proxy environments under certain conditions due to improper input validation in import functionality.
Title		Improper Neutralization of CRLF Sequences ('CRLF Injection') in GitLab
First Time appeared		Gitlab Gitlab gitlab
Weaknesses		CWE-93
CPEs		cpe:2.3:a:gitlab:gitlab::::::::
Vendors & Products		Gitlab Gitlab gitlab
References		https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/ https://gitlab.com/gitlab-org/gitlab/-/work_items/577298
Metrics		cvssV3_1 `{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N'}`