CVE-2026-1662

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1662", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-01-29T20:33:16.301Z", "datePublished": "2026-02-25T20:04:59.913Z", "dateUpdated": "2026-02-26T15:10:46.924Z"}, "containers": {"cna": {"title": "Allocation of Resources Without Limits or Throttling in GitLab", "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint."}], "affected": [{"vendor": "GitLab", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "versions": [{"version": "14.4", "status": "affected", "lessThan": "18.7.5", "versionType": "semver"}, {"version": "18.8", "status": "affected", "lessThan": "18.8.5", "versionType": "semver"}, {"version": "18.9", "status": "affected", "lessThan": "18.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "cweId": "CWE-770", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/588206", "name": "GitLab Issue #588206", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/3519694", "name": "HackerOne Bug Bounty Report #3519694", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.7.5, 18.8.5, 18.9.1 or above."}], "credits": [{"lang": "en", "value": "Thanks [a92847865](https://hackerone.com/a92847865) for reporting this vulnerability through our HackerOne bug bounty program", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-02-25T20:04:59.913Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T15:10:25.803586Z", "id": "CVE-2026-1662", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:10:46.924Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1662", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T15:10:25.803586Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:10:32.968Z"}}], "cna": {"title": "Allocation of Resources Without Limits or Throttling in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "Thanks [a92847865](https://hackerone.com/a92847865) for reporting this vulnerability through our HackerOne bug bounty program"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "14.4", "lessThan": "18.7.5", "versionType": "semver"}, {"status": "affected", "version": "18.8", "lessThan": "18.8.5", "versionType": "semver"}, {"status": "affected", "version": "18.9", "lessThan": "18.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.7.5, 18.8.5, 18.9.1 or above."}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/588206", "name": "GitLab Issue #588206", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/3519694", "name": "HackerOne Bug Bounty Report #3519694", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/"}], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-02-25T20:04:59.913Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1662", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:10:46.924Z", "dateReserved": "2026-01-29T20:33:16.301Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-02-25T20:04:59.913Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [{"lessThan": "18.7.5", "status": "affected", "version": "14.4", "versionType": "semver"}, {"lessThan": "18.8.5", "status": "affected", "version": "18.8", "versionType": "semver"}, {"lessThan": "18.9.1", "status": "affected", "version": "18.9", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "F90F606F-E507-49C1-9736-4CC4B738F9CD", "versionEndExcluding": "18.7.5", "versionStartIncluding": "14.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "65AAA10B-37E8-435F-AF35-45BE7E471767", "versionEndExcluding": "18.7.5", "versionStartIncluding": "14.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "432C7223-F8B6-4EBA-84E2-2BB8A0F367D2", "versionEndExcluding": "18.8.5", "versionStartIncluding": "18.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "630677C7-21EB-4E91-BB15-4610DCD22F98", "versionEndExcluding": "18.8.5", "versionStartIncluding": "18.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:18.9.0:*:*:*:community:*:*:*", "matchCriteriaId": "795727F0-1B38-483F-BEE8-FB252EE57AC9", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:18.9.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "73CCBA34-57C3-454D-A898-5D216EE1D5E9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint."}, {"lang": "es", "value": "GitLab ha remediado un problema en GitLab CE/EE que afecta a todas las versiones desde la 14.4 y anteriores a la 18.7.5, la 18.8 y anteriores a la 18.8.5, y la 18.9 y anteriores a la 18.9.1 que podr\u00eda haber permitido a un usuario no autenticado causar denegaci\u00f3n de servicio mediante el env\u00edo de solicitudes especialmente dise\u00f1adas al endpoint de eventos de Jira."}], "id": "CVE-2026-1662", "lastModified": "2026-06-17T10:16:16.363", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "cve@gitlab.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1662", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T15:10:25.803586Z", "version": "2.0.3"}}]}, "published": "2026-02-25T21:16:36.670", "references": [{"source": "cve@gitlab.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/"}, {"source": "cve@gitlab.com", "tags": ["Broken Link"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/588206"}, {"source": "cve@gitlab.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/3519694"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[14.4,18.7.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18.8,18.8.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18.9,18.9.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "GitLab", "source": "cna", "vendor": "GitLab"}, "product": "gitlab", "vendor": "gitlab"}], "analysis": {"en": {"generated_at": "2026-04-17T14:55:56.698415+00:00", "value": {"mitigation_remediation": ["Upgrade GitLab to version 18.7.5, 18.8.5, 18.9.1, or any later release on both the CE and EE versions. ", "Restrict unauthenticated access to the Jira events endpoint by enforcing authentication or role\u2011based access control. ", "Deploy a web application firewall rule or API gateway throttling mechanism to limit the rate of requests to the Jira events endpoint, preventing resource exhaustion."], "summary": {"action": "Patch Now", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "All supported GitLab Community Edition releases from 14.4 up to, but not including, 18.7.5, all Enterprise Edition releases from 14.4 up to, but not including, 18.7.5, the 18.8 series before 18.8.5, and the 18.9 series before 18.9.1 are affected. The issue applies to both community and enterprise editions and triggers when the Jira events API is called by an unauthenticated user.", "description_and_impact": "GitLab Community Edition and Enterprise Edition contain a flaw that lets an unauthenticated user send specially crafted requests to the Jira events endpoint. The flaw causes the system to allocate resources without any limits or throttling, allowing the attacker to exhaust server resources and disrupt legitimate traffic. The primary impact is a denial of service to all users who rely on the affected GitLab instance.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 7.5, indicating high severity, while the EPSS score is below 1%, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. An attacker can exploit it over the network by sending crafted HTTP POST requests to the Jira events endpoint without authentication. Successful exploitation can result in resource exhaustion and service interruption for all users of the GitLab instance."}}}}, "created": "2026-02-26T13:14:45.029413+00:00", "updated": "2026-04-17T15:00:11.030815+00:00", "vendors": ["gitlab", "gitlab$PRODUCT$gitlab"], "weaknesses": ["CWE-770"]}