Executive brief
GitLab is a popular development platform used by teams to manage source code, CI/CD pipelines, and collaboration. An unauthenticated attacker can send specially crafted requests to GitLab's GraphQL API that exploit improper resource allocation limits, causing the service to become unavailable and preventing legitimate users from accessing the platform.
Technical details
This vulnerability exists in GitLab's GraphQL complexity calculation logic, which is responsible for preventing resource exhaustion from complex queries. The vulnerability allows an unauthenticated user to bypass or circumvent the complexity limits through improper resource allocation enforcement. An attacker can send a malicious GraphQL query over the network without authentication to trigger a denial of service condition. The affected versions span GitLab CE/EE 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. Patches are available in the fixed versions released on September 10, 2026.
Affected products
- GitLab GitLab CE 18.4.6 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
- GitLab GitLab EE 18.4.6 before 19.1.8, 19.2 before 19.2.6, 19.3 before 19.3.2
Timeline
- 2026-09-16: disclosed
- 2026-09-10: patched: Patches released for GitLab CE/EE versions 19.3.2, 19.2.6, and 19.1.8