CVE-2026-1387

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1387", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-01-23T20:33:15.394Z", "datePublished": "2026-02-11T11:04:20.771Z", "dateUpdated": "2026-02-11T21:17:29.372Z"}, "containers": {"cna": {"title": "Allocation of Resources Without Limits or Throttling in GitLab", "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to cause Denial of Service by uploading a malicious file and repeatedly querying it through GraphQl."}], "affected": [{"vendor": "GitLab", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "versions": [{"version": "15.6", "status": "affected", "lessThan": "18.6.6", "versionType": "semver"}, {"version": "18.7", "status": "affected", "lessThan": "18.7.4", "versionType": "semver"}, {"version": "18.8", "status": "affected", "lessThan": "18.8.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "cweId": "CWE-770", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/587546", "name": "GitLab Issue #587546", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/3515994", "name": "HackerOne Bug Bounty Report #3515994", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.6.6, 18.7.4, 18.8.4 or above."}], "credits": [{"lang": "en", "value": "Thanks [a92847865](https://hackerone.com/a92847865) for reporting this vulnerability through our HackerOne bug bounty program", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-02-11T11:04:20.771Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T21:17:22.725712Z", "id": "CVE-2026-1387", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T21:17:29.372Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1387", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T21:17:22.725712Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T21:17:26.639Z"}}], "cna": {"title": "Allocation of Resources Without Limits or Throttling in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "Thanks [a92847865](https://hackerone.com/a92847865) for reporting this vulnerability through our HackerOne bug bounty program"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "15.6", "lessThan": "18.6.6", "versionType": "semver"}, {"status": "affected", "version": "18.7", "lessThan": "18.7.4", "versionType": "semver"}, {"status": "affected", "version": "18.8", "lessThan": "18.8.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.6.6, 18.7.4, 18.8.4 or above."}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/587546", "name": "GitLab Issue #587546", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/3515994", "name": "HackerOne Bug Bounty Report #3515994", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/"}], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to cause Denial of Service by uploading a malicious file and repeatedly querying it through GraphQl."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-02-11T11:04:20.771Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1387", "state": "PUBLISHED", "dateUpdated": "2026-02-11T21:17:29.372Z", "dateReserved": "2026-01-23T20:33:15.394Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-02-11T11:04:20.771Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [{"lessThan": "18.6.6", "status": "affected", "version": "15.6", "versionType": "semver"}, {"lessThan": "18.7.4", "status": "affected", "version": "18.7", "versionType": "semver"}, {"lessThan": "18.8.4", "status": "affected", "version": "18.8", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "3F0CFD5D-2A9D-49FD-A315-392CB1E1277F", "versionEndExcluding": "18.6.6", "versionStartIncluding": "15.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "DA7B13F4-05B9-436E-A1DC-6C65DB7B44FE", "versionEndExcluding": "18.7.4", "versionStartIncluding": "18.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "6D01D64A-0619-427D-B351-4101FC257674", "versionEndExcluding": "18.8.4", "versionStartIncluding": "18.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to cause Denial of Service by uploading a malicious file and repeatedly querying it through GraphQl."}, {"lang": "es", "value": "GitLab ha remediado un problema en GitLab EE que afecta a todas las versiones desde la 15.6 anterior a la 18.6.6, la 18.7 anterior a la 18.7.4, y la 18.8 anterior a la 18.8.4 que podr\u00eda haber permitido a un usuario autenticado causar una denegaci\u00f3n de servicio al subir un archivo malicioso y consultarlo repetidamente a trav\u00e9s de GraphQl."}], "id": "CVE-2026-1387", "lastModified": "2026-06-17T10:15:41.383", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "cve@gitlab.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1387", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T21:17:22.725712Z", "version": "2.0.3"}}]}, "published": "2026-02-11T12:16:04.547", "references": [{"source": "cve@gitlab.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/"}, {"source": "cve@gitlab.com", "tags": ["Broken Link", "Issue Tracking"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/587546"}, {"source": "cve@gitlab.com", "tags": ["Broken Link"], "url": "https://hackerone.com/reports/3515994"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[15.6,18.6.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.7,18.7.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.8,18.8.4)"}}], "product": "gitlab", "vendor": "gitlab"}], "analysis": {"en": {"generated_at": "2026-04-17T20:24:39.305542+00:00", "value": {"mitigation_remediation": ["Upgrade GitLab to at least version 18.6.6, 18.7.4, or 18.8.4.", "If an upgrade cannot be performed immediately, limit the rate of GraphQL queries per authenticated user or temporarily revoke permissions for uploading and querying files that can trigger heavy resource usage.", "Deploy monitoring to detect unusually high memory or CPU consumption associated with file uploads or GraphQL activity, and take corrective action such as throttling or scaling resources accordingly."], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected product is GitLab Enterprise Edition. All GitLab EE releases from version 15.6 up to, but not including, 18.6.6; version 18.7 up to, but not including, 18.7.4; and version 18.8 up to, but not including, 18.8.4 are impacted. The vendor recommends upgrading to GitLab 18.6.6, 18.7.4, 18.8.4 or later to remediate the issue.", "description_and_impact": "GitLab implements a resource exhaustion flaw that allows an authenticated user to upload a malicious file and repeatedly query it through GraphQL, causing the application to allocate memory and CPU resources without limit, ultimately resulting in a denial of service.", "risk_and_exploitability": "The CVSS score of 6.5 indicates a moderate to high severity. The EPSS score of less than 1% implies a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker would need authenticated access to the system and must repeatedly execute GraphQL queries targeting a maliciously uploaded file. If these requests are unthrottled, the application can become overwhelmed, leading to service interruption for users."}}}}, "created": "2026-02-11T21:45:48.667807+00:00", "updated": "2026-04-17T20:30:15.812724+00:00", "vendors": ["gitlab", "gitlab$PRODUCT$gitlab"]}