Executive brief
GitLab is a widely-used DevOps platform that hosts source code repositories and CI/CD pipelines. An unauthenticated attacker can send specially crafted GraphQL queries to crash or degrade the availability of GitLab instances by exploiting improper resource allocation limits in the GraphQL complexity calculation logic. This could disrupt development teams' access to code, pipelines, and project management features.
Technical details
This is a denial of service vulnerability in GitLab's GraphQL API caused by improper resource allocation limits in the complexity calculation logic. The vulnerability allows an unauthenticated user to craft GraphQL queries that bypass or exhaust complexity checks, consuming excessive server resources and causing service degradation or unavailability. The attack is network-accessible and requires no authentication or user interaction. Exploitation can result in denial of service affecting the availability of the GitLab instance. Patches are available in versions 19.3.2, 19.2.6, and 19.1.8, and all affected installations should upgrade immediately.
Affected products
- GitLab GitLab CE 18.4.6 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
- GitLab GitLab EE 18.4.6 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
Timeline
- 2026-09-16: disclosed
- 2026-09-10: patched: Patches released for versions 19.3.2, 19.2.6, 19.1.8