Executive brief
GitLab is a collaboration and continuous integration platform used by development teams to manage code and automate software builds. An authenticated user can exploit a missing object count limit in the import pipeline to consume excessive system resources and disrupt background job processing for all users on the instance, effectively making the platform unavailable.
Technical details
This is a denial of service vulnerability (CWE-770, Allocation of Resources Without Limits) in GitLab's import pipeline functionality. An authenticated user can trigger the vulnerability by importing objects without proper count restrictions, causing unbounded resource consumption in background job processing. The attack requires authentication and network access but no user interaction beyond the malicious import request. Successful exploitation results in degraded or unavailable service for all users on the affected GitLab instance. Patches are available in versions 19.1.7, 19.2.5, and 19.3.1 for both Community Edition and Enterprise Edition.
Affected products
- GitLab Community Edition 12.8 to 19.1.6, 19.2.0 to 19.2.4, 19.3.0
- GitLab Enterprise Edition 12.8 to 19.1.6, 19.2.0 to 19.2.4, 19.3.0
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: GitLab 19.1.7, 19.2.5, 19.3.1 released