CVE-2026-1402

Vulnerability

GitLab CE/EE versions from 17.1 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 contain a vulnerability where insufficient validation of user-supplied input under specific conditions allows an authenticated user to trigger a denial of service [1]. The exact code path is not publicly detailed, but the issue resides in the application's request handling logic.

Exploitation

An attacker must be an authenticated user of the GitLab instance. No additional privileges beyond standard user access are required. The attacker sends crafted requests that exploit the validation flaw, causing the application to consume excessive resources or enter an unresponsive state [1]. The specific sequence of steps is not disclosed in the available reference.

Impact

Successful exploitation results in a denial of service, rendering the GitLab instance unavailable or severely degraded for legitimate users. No data confidentiality or integrity impact has been reported [1].

Mitigation

GitLab has released fixed versions: 18.10.7, 18.11.4, and 19.0.1 on 2026-05-27 [1]. Users should upgrade to one of these versions immediately. No workarounds are documented.