Executive brief
GitLab has addressed a security vulnerability in its Community and Enterprise editions that could allow a registered user to crash the service. By providing specifically crafted input, an attacker can force the system to consume excessive memory, leading to a denial of service. This could disrupt software development workflows and prevent teams from accessing their code repositories and CI/CD pipelines.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in GitLab CE/EE due to improper input validation. An authenticated attacker with network access can submit malicious input that causes the application to allocate excessive memory. This leads to a denial of service (DoS) condition, potentially crashing the GitLab instance or making it unresponsive. The issue affects versions starting from 8.3 and has been patched in versions 18.9.7, 18.10.6, and 18.11.3.
Affected products
- GitLab GitLab Community Edition (CE) / Enterprise Edition (EE) 8.3 to < 18.9.7, 18.10 to < 18.10.6, 18.11 to < 18.11.3
Timeline
- 2026-05-13: patched: GitLab released versions 18.9.7, 18.10.6, and 18.11.3 to address the issue.
- 2026-05-14: disclosed: CVE-2026-8280 was published.