Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

GitLab can be stopped by unauthenticated user

CVE-2026-1168 · published 1 month ago
Summary

All supported versions of GitLab Community and Enterprise Edition may let anyone without a login send specially crafted requests that consume unlimited processing power, causing the service to become unavailable. This happens because the system does not limit how complex a GraphQL query can be. Upgrade to the latest GitLab release or apply the provided security patch to restore proper resource limits and keep the service running.

What to do
  • Update gitlab to version 19.3.2.
Affected software
Ecosystem VendorProductAffected versions
– gitlab gitlab < 19.1.8
>= 18.4.6, < 19.1.8
>= 19.2.0, < 19.2.6
>= 19.3.0, < 19.3.2
Bitnami – gitlab >= 19.3.0, < 19.3.2
Fix: upgrade to 19.3.2
Original advisory text
Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published16 Sep 2026
Updated4 Nov 2026
First seen16 Sep 2026
Sources
CVE-2026-1168 · NVD
CVE-2026-1168 · MITRE
BIT-gitlab-2026-1168 · OSV
CVE-2026-1168 · OSV
Track software like this
Free during beta