Medium severity6.5NVD Advisory· Published Feb 11, 2026· Updated Jun 17, 2026
CVE-2026-1456
CVE-2026-1456
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through CPU exhaustion by submitting specially crafted markdown files that trigger exponential processing in markdown preview.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
47cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 18.7
- (no CPE)range: from 18.7 before 18.7.4, and 18.8 before 18.8.4
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=18.7.0,<18.7.4
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=18.7.0,<18.7.4
- osv-coords42 versionspkg:apk/chainguard/gitlab-docker-machine-18.7pkg:apk/chainguard/gitlab-docker-machine-fips-18.7pkg:apk/chainguard/gitlab-docker-machine-fips-18.8pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.8pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.7pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.8pkg:apk/chainguard/gitlab-rails-ce-fips-18.7pkg:apk/chainguard/gitlab-rails-ce-fips-18.8pkg:apk/chainguard/gitlab-runner-18.8pkg:apk/chainguard/gitlab-runner-fips-18.7pkg:apk/chainguard/gitlab-runner-fips-18.8pkg:apk/chainguard/gitlab-runner-helper-18.7pkg:apk/chainguard/gitlab-runner-helper-18.8pkg:apk/chainguard/gitlab-runner-helper-compat-18.7pkg:apk/chainguard/gitlab-runner-helper-compat-18.8pkg:apk/chainguard/gitlab-runner-helper-compat-fips-18.7pkg:apk/chainguard/gitlab-runner-helper-compat-fips-18.8pkg:apk/chainguard/gitlab-runner-helper-fips-18.7pkg:apk/chainguard/gitlab-runner-helper-fips-18.8pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-18.7pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-18.8pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-fips-18.7pkg:apk/chainguard/gitlab-runner-helper-oci-entrypoint-fips-18.8pkg:apk/chainguard/gitlab-runner-oci-entrypoint-18.7pkg:apk/chainguard/gitlab-runner-oci-entrypoint-18.8pkg:apk/chainguard/gitlab-runner-oci-entrypoint-fips-18.7pkg:apk/wolfi/gitlab-docker-machine-18.7pkg:apk/wolfi/gitlab-runner-18.7pkg:apk/wolfi/gitlab-runner-18.8pkg:apk/wolfi/gitlab-runner-helper-18.7pkg:apk/wolfi/gitlab-runner-helper-18.8pkg:apk/wolfi/gitlab-runner-helper-compat-18.7pkg:apk/wolfi/gitlab-runner-helper-compat-18.8pkg:apk/wolfi/gitlab-runner-helper-oci-entrypoint-18.7pkg:apk/wolfi/gitlab-runner-helper-oci-entrypoint-18.8pkg:apk/wolfi/gitlab-runner-oci-entrypoint-18.8pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.7pkg:apk/wolfi/gitlab-runner-oci-entrypoint-18.7pkg:apk/chainguard/gitlab-runner-oci-entrypoint-fips-18.8pkg:bitnami/gitlabpkg:apk/chainguard/gitlab-runner-18.7pkg:apk/chainguard/gitlab-pages-fips-18.8
< 18.7.2-r3+ 41 more
- (no CPE)range: < 18.7.2-r3
- (no CPE)range: < 18.7.2-r4
- (no CPE)range: < 18.8.0-r2
- (no CPE)range: < 18.8.4-r0
- (no CPE)range: < 18.7.4-r0
- (no CPE)range: < 18.8.4-r0
- (no CPE)range: < 18.7.4-r0
- (no CPE)range: < 18.8.4-r0
- (no CPE)range: < 18.8.0-r1
- (no CPE)range: < 18.7.2-r4
- (no CPE)range: < 18.8.0-r2
- (no CPE)range: < 18.7.2-r3
- (no CPE)range: < 18.8.0-r1
- (no CPE)range: < 18.7.2-r3
- (no CPE)range: < 18.8.0-r1
- (no CPE)range: < 18.7.2-r4
- (no CPE)range: < 18.8.0-r2
- (no CPE)range: < 18.7.2-r4
- (no CPE)range: < 18.8.0-r2
- (no CPE)range: < 18.7.2-r3
- (no CPE)range: < 18.8.0-r1
- (no CPE)range: < 18.7.2-r4
- (no CPE)range: < 18.8.0-r2
- (no CPE)range: < 18.7.2-r3
- (no CPE)range: < 18.8.0-r1
- (no CPE)range: < 18.7.2-r4
- (no CPE)range: < 18.7.2-r3
- (no CPE)range: < 18.7.2-r3
- (no CPE)range: < 18.8.0-r1
- (no CPE)range: < 18.7.2-r3
- (no CPE)range: < 18.8.0-r1
- (no CPE)range: < 18.7.2-r3
- (no CPE)range: < 18.8.0-r1
- (no CPE)range: < 18.7.2-r3
- (no CPE)range: < 18.8.0-r1
- (no CPE)range: < 18.8.0-r1
- (no CPE)range: < 18.7.4-r0
- (no CPE)range: < 18.7.2-r3
- (no CPE)range: < 18.8.0-r2
- (no CPE)range: >= 18.7.0, < 18.7.4
- (no CPE)range: < 18.7.2-r3
- (no CPE)range: < 18.8.4-r0
- Range: from 18.7 before 18.7.4, and 18.8 before 18.8.4
Patches
Vulnerability mechanics
References
3- about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/nvdRelease NotesVendor Advisory
- gitlab.com/gitlab-org/gitlab/-/issues/587688nvdBroken LinkIssue Tracking
- hackerone.com/reports/3517928nvdPermissions Required
News mentions
1- GitLab Patch Release: 18.8.4, 18.7.4, 18.6.6GitLab Security Releases · Feb 10, 2026