CVE-2026-1456

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1456", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-01-26T20:33:14.058Z", "datePublished": "2026-02-11T11:04:15.246Z", "dateUpdated": "2026-02-11T15:40:00.821Z"}, "containers": {"cna": {"title": "Allocation of Resources Without Limits or Throttling in GitLab", "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through CPU exhaustion by submitting specially crafted markdown files that trigger exponential processing in markdown preview."}], "affected": [{"vendor": "GitLab", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "versions": [{"version": "18.7", "status": "affected", "lessThan": "18.7.4", "versionType": "semver"}, {"version": "18.8", "status": "affected", "lessThan": "18.8.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "cweId": "CWE-770", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/587688", "name": "GitLab Issue #587688", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/3517928", "name": "HackerOne Bug Bounty Report #3517928", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.7.4, 18.8.4 or above."}], "credits": [{"lang": "en", "value": "Thanks [maksyche](https://hackerone.com/maksyche) for reporting this vulnerability through our HackerOne bug bounty program", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-02-11T11:04:15.246Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T15:38:41.451429Z", "id": "CVE-2026-1456", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:40:00.821Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1456", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T15:38:41.451429Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:39:55.633Z"}}], "cna": {"title": "Allocation of Resources Without Limits or Throttling in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "Thanks [maksyche](https://hackerone.com/maksyche) for reporting this vulnerability through our HackerOne bug bounty program"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "18.7", "lessThan": "18.7.4", "versionType": "semver"}, {"status": "affected", "version": "18.8", "lessThan": "18.8.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.7.4, 18.8.4 or above."}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/587688", "name": "GitLab Issue #587688", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/3517928", "name": "HackerOne Bug Bounty Report #3517928", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/"}], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through CPU exhaustion by submitting specially crafted markdown files that trigger exponential processing in markdown preview."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-02-11T11:04:15.246Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1456", "state": "PUBLISHED", "dateUpdated": "2026-02-11T15:40:00.821Z", "dateReserved": "2026-01-26T20:33:14.058Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-02-11T11:04:15.246Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [{"lessThan": "18.7.4", "status": "affected", "version": "18.7", "versionType": "semver"}, {"lessThan": "18.8.4", "status": "affected", "version": "18.8", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "EB4484C1-2D91-48A6-B396-4F16DC598828", "versionEndExcluding": "18.7.4", "versionStartIncluding": "18.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "DA7B13F4-05B9-436E-A1DC-6C65DB7B44FE", "versionEndExcluding": "18.7.4", "versionStartIncluding": "18.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "BCEB62DB-0D85-4A21-99C4-6235CA97A795", "versionEndExcluding": "18.8.4", "versionStartIncluding": "18.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "6D01D64A-0619-427D-B351-4101FC257674", "versionEndExcluding": "18.8.4", "versionStartIncluding": "18.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through CPU exhaustion by submitting specially crafted markdown files that trigger exponential processing in markdown preview."}, {"lang": "es", "value": "GitLab ha remediado un problema en GitLab CE/EE que afectaba a todas las versiones desde la 18.7 hasta las anteriores a la 18.7.4, y desde la 18.8 hasta las anteriores a la 18.8.4, que podr\u00eda haber permitido a un usuario no autenticado causar denegaci\u00f3n de servicio mediante el agotamiento de la CPU al enviar archivos markdown especialmente dise\u00f1ados que desencadenan un procesamiento exponencial en la vista previa de markdown."}], "id": "CVE-2026-1456", "lastModified": "2026-06-17T10:15:49.427", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "cve@gitlab.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1456", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T15:38:41.451429Z", "version": "2.0.3"}}]}, "published": "2026-02-11T12:16:04.703", "references": [{"source": "cve@gitlab.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/"}, {"source": "cve@gitlab.com", "tags": ["Broken Link", "Issue Tracking"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/587688"}, {"source": "cve@gitlab.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/3517928"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.7,18.7.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.8,18.8.4)"}}], "product": "gitlab", "vendor": "gitlab"}], "analysis": {"en": {"generated_at": "2026-04-18T12:41:50.945876+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch by upgrading to GitLab 18.7.4 or 18.8.4 or newer.", "If upgrading cannot be performed immediately, temporarily restrict or disable markdown preview functionality for unauthenticated users and enforce rate limiting on the markdown preview endpoint to prevent excessive CPU usage.", "Monitor system performance metrics including CPU utilization and memory usage for spikes associated with markdown rendering, and configure alerts to notify administrators of potential abuse; consider deploying a dedicated reverse proxy that limits concurrent preview requests."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "GitLab Community and Enterprise editions are affected. Versions 18.7 and 18.8 that fall below the patch releases 18.7.4 and 18.8.4 are vulnerable. All earlier 18.7.x and 18.8.x deployments must be upgraded to the indicated versions or later.", "description_and_impact": "GitLab introduced a flaw where freshly uploaded markdown could be processed without any limits, resulting in exponential growth in processing time and CPU consumption. An unauthenticated user can trigger this by crafting a special markdown file, leading to a denial of service that impairs the availability of the entire instance. The weakness is a classic example of Resource Exhaustion, categorized as CWE-770.", "risk_and_exploitability": "The vulnerability has a CVSS score of 6.5, indicating a moderately high severity impact and exploitation difficulty. EPSS is less than 1%, suggesting that the likelihood of real-world exploitation is currently low, and the issue is not listed in the CISA KEV catalog. Attackers need only an unauthenticated web session and can submit a markdown file to the preview endpoint. The vulnerability does not require privileged access or remote code execution; it simply taxes system resources until the instance becomes unusable."}}}}, "created": "2026-02-11T21:45:49.396193+00:00", "updated": "2026-04-18T12:45:45.674342+00:00", "vendors": ["gitlab", "gitlab$PRODUCT$gitlab"]}