Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing object count limits.
Published: 2026-08-26
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

GitLab allows an authenticated user to trigger a denial of service by exploiting missing limits on object allocation, causing background job processing to fail. The flaw is a classic example of CWE‑770, where uncontrolled resource consumption can degrade or halt system functionality.

Affected Systems

The vulnerability affects all GitLab Community and Enterprise editions from version 12.8 through the released patch versions 19.1.7, 19.2.5, and 19.3.1. Any installation using a GitLab version earlier than these PPG releases is susceptible.

Risk and Exploitability

With a CVSS score of 6.5, the security impact is moderate and the attack requires authenticated access. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, implying a lower public exploitation likelihood. Nonetheless, an attacker who can authenticate could intentionally overload the system’s background job queue, leading to service disruption.

Generated by OpenCVE AI on August 26, 2026 at 14:37 UTC.

Remediation

Vendor Solution

Upgrade to versions 19.1.7, 19.2.5, 19.3.1 or above.

OpenCVE Recommended Actions

  • Upgrade GitLab to version 19.1.7, 19.2.5, 19.3.1, or any later release that includes the resource‑limit fix.
  • If an immediate upgrade is infeasible, reconfigure background job settings to enforce tighter limits on parallelism and object count to mitigate excessive resource use.
  • Continuously monitor job queue metrics and set alerts for abnormal resource consumption so that any attempted exploitation can be detected early.

Generated by OpenCVE AI on August 26, 2026 at 14:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:19.3.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:19.3.0:*:*:*:enterprise:*:*:*

Fri, 28 Aug 2026 06:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 13:45:00 +0000

Type Values Removed Values Added
Description GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing object count limits.
Title Allocation of Resources Without Limits or Throttling in GitLab
First Time appeared Gitlab
Gitlab gitlab
Weaknesses CWE-770
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
Vendors & Products Gitlab
Gitlab gitlab
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Gitlab Gitlab
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-08-26T15:55:52.127Z

Reserved: 2026-08-21T13:35:48.906Z

Link: CVE-2026-77801

cve-icon Vulnrichment

Updated: 2026-08-26T15:55:49.039Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-26T14:17:15.757

Modified: 2026-08-31T15:42:30.373

Link: CVE-2026-77801

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T18:30:02Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling