Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.
Published: 2026-08-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from GitLab's allocation of resources without limits or throttling when processing input from unauthenticated users. This flaw can lead to a denial of service if an attacker sends specially crafted data that bypasses validation and forces the system to consume excessive memory or CPU, thereby disrupting service availability. The weakness is classified as CWE‑770.

Affected Systems

GitLab Community Edition and Enterprise Edition are impacted. Versions from 18.5 up to before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 are vulnerable. All other later releases have been remediated.

Risk and Exploitability

The CVSS score is 5.3, indicating moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. Attackers would need to be able to send unauthenticated requests to the affected GitLab instance, likely through the web interface or API, and supply crafted input that triggers uncontrolled allocation. No public exploit has been observed, but the lack of limits means that a successful attack could degrade availability of the entire GitLab service.

Generated by OpenCVE AI on August 13, 2026 at 00:14 UTC.

Remediation

Vendor Solution

Upgrade to versions 19.0.6, 19.1.4, 19.2.2 or above.

OpenCVE Recommended Actions

  • Upgrade GitLab to the patched release: 19.0.6 for 18.x, 19.1.4 for 19.1, or 19.2.2 for 19.2; any later version is acceptable.
  • Restrict unauthenticated access to GitLab services using firewall rules or access control lists to reduce the attack surface before the patch is applied.
  • If possible, enable or configure request throttling or resource limits in GitLab to prevent excessive consumption of system resources until the patch is deployed.

Generated by OpenCVE AI on August 13, 2026 at 00:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 16:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Thu, 13 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Description GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.
Title Allocation of Resources Without Limits or Throttling in GitLab
First Time appeared Gitlab
Gitlab gitlab
Weaknesses CWE-770
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
Vendors & Products Gitlab
Gitlab gitlab
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Gitlab Gitlab
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-08-13T14:55:04.449Z

Reserved: 2026-04-29T14:34:46.326Z

Link: CVE-2026-7427

cve-icon Vulnrichment

Updated: 2026-08-13T14:54:58.732Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-12T18:18:16.157

Modified: 2026-08-19T15:57:57.313

Link: CVE-2026-7427

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T00:15:04Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling