Executive brief
GitLab is a platform used by software development teams to manage code and automate deployments. A security flaw has been identified where a logged-in user can upload a specially crafted file to exhaust the server's resources. This can lead to a denial-of-service (DoS) condition, making the GitLab instance unavailable to other users and disrupting development operations.
Technical details
A denial-of-service (DoS) vulnerability exists in GitLab CE/EE due to uncontrolled resource consumption (CWE-770) during the processing of file uploads. An authenticated attacker can exploit this by uploading a specially crafted file, leading to excessive resource usage that can crash or hang the service. The vulnerability affects versions 17.10 through 18.10.8, 18.11 through 18.11.5, and 19.0 through 19.0.2. GitLab has released patches in versions 18.10.8, 18.11.5, and 19.0.2 to address this issue. Exploitation requires network access and valid user credentials (low privileges).
Affected products
- GitLab GitLab Community Edition (CE) >=17.10, <18.10.8
- GitLab GitLab Enterprise Edition (EE) >=17.10, <18.10.8
- GitLab GitLab Community Edition (CE) >=18.11, <18.11.5
- GitLab GitLab Enterprise Edition (EE) >=18.11, <18.11.5
- GitLab GitLab Community Edition (CE) >=19.0, <19.0.2
- GitLab GitLab Enterprise Edition (EE) >=19.0, <19.0.2
Timeline
- 2026-06-10: patched: GitLab released versions 18.10.8, 18.11.5, and 19.0.2
- 2026-06-11: disclosed: CVE-2026-1500 published