Executive brief
GitLab has fixed a security vulnerability in its software development platform that could allow an unauthorized person to crash the service. By sending specially crafted data to the Terraform state lock component, an attacker could make the system unavailable to legitimate users. This affects both the Community and Enterprise editions of self-managed GitLab installations.
Technical details
A denial of service (DoS) vulnerability exists in GitLab CE/EE within the Terraform state lock API. The flaw is caused by improper validation of specified quantities in JSON payloads (CWE-1284). An unauthenticated remote attacker can exploit this by sending malicious JSON payloads to the affected endpoint, leading to resource exhaustion or service instability. The issue affects a wide range of versions starting from 12.10. GitLab has released patches in versions 18.8.9, 18.9.5, and 18.10.3 to address this vulnerability.
Affected products
- GitLab GitLab CE/EE 12.10 to 18.8.9, 18.9 to 18.9.5, 18.10 to 18.10.3
Timeline
- 2026-04-08: patched: GitLab released versions 18.10.3, 18.9.5, 18.8.9
- 2026-04-08: advisory