CVE-2026-2845

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2845", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-02-20T06:04:23.184Z", "datePublished": "2026-02-25T20:04:35.210Z", "dateUpdated": "2026-02-26T15:45:14.406Z"}, "containers": {"cna": {"title": "Allocation of Resources Without Limits or Throttling in GitLab", "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an authenticated user to cause denial of service by exploiting a Bitbucket Server import endpoint via repeatedly sending large responses."}], "affected": [{"vendor": "GitLab", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "versions": [{"version": "11.2", "status": "affected", "lessThan": "18.7.5", "versionType": "semver"}, {"version": "18.8", "status": "affected", "lessThan": "18.8.5", "versionType": "semver"}, {"version": "18.9", "status": "affected", "lessThan": "18.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "cweId": "CWE-770", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/570554"}, {"url": "https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.7.5, 18.8.5, 18.9.1 or above."}], "credits": [{"lang": "en", "value": "This vulnerability has been discovered internally by GitLab team member [Sam Word](https://gitlab.com/SamWord)", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-02-25T20:04:35.210Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T15:44:35.776720Z", "id": "CVE-2026-2845", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:45:14.406Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2845", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T15:44:35.776720Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:45:02.580Z"}}], "cna": {"title": "Allocation of Resources Without Limits or Throttling in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "This vulnerability has been discovered internally by GitLab team member [Sam Word](https://gitlab.com/SamWord)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "11.2", "lessThan": "18.7.5", "versionType": "semver"}, {"status": "affected", "version": "18.8", "lessThan": "18.8.5", "versionType": "semver"}, {"status": "affected", "version": "18.9", "lessThan": "18.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.7.5, 18.8.5, 18.9.1 or above."}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/570554"}, {"url": "https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/"}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an authenticated user to cause denial of service by exploiting a Bitbucket Server import endpoint via repeatedly sending large responses."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-02-25T20:04:35.210Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2845", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:45:14.406Z", "dateReserved": "2026-02-20T06:04:23.184Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-02-25T20:04:35.210Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [{"lessThan": "18.7.5", "status": "affected", "version": "11.2", "versionType": "semver"}, {"lessThan": "18.8.5", "status": "affected", "version": "18.8", "versionType": "semver"}, {"lessThan": "18.9.1", "status": "affected", "version": "18.9", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "2C284DA2-89BA-4728-B503-BF3279EFE9BB", "versionEndExcluding": "18.7.5", "versionStartIncluding": "11.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "5F9A1A01-1984-4982-8650-39DD7DFDBA4F", "versionEndExcluding": "18.7.5", "versionStartIncluding": "11.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "432C7223-F8B6-4EBA-84E2-2BB8A0F367D2", "versionEndExcluding": "18.8.5", "versionStartIncluding": "18.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "630677C7-21EB-4E91-BB15-4610DCD22F98", "versionEndExcluding": "18.8.5", "versionStartIncluding": "18.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:18.9.0:*:*:*:community:*:*:*", "matchCriteriaId": "795727F0-1B38-483F-BEE8-FB252EE57AC9", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:18.9.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "73CCBA34-57C3-454D-A898-5D216EE1D5E9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an authenticated user to cause denial of service by exploiting a Bitbucket Server import endpoint via repeatedly sending large responses."}, {"lang": "es", "value": "Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 11.2 anterior a la 18.7.5, la 18.8 anterior a la 18.8.5 y la 18.9 anterior a la 18.9.1 que podr\u00eda haber permitido a un usuario autenticado causar una denegaci\u00f3n de servicio al explotar un endpoint de importaci\u00f3n del servidor de Bitbucket mediante el env\u00edo repetido de respuestas grandes."}], "id": "CVE-2026-2845", "lastModified": "2026-06-17T10:31:52.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "cve@gitlab.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2845", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T15:44:35.776720Z", "version": "2.0.3"}}]}, "published": "2026-02-25T21:16:44.547", "references": [{"source": "cve@gitlab.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/"}, {"source": "cve@gitlab.com", "tags": ["Broken Link"], "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/570554"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "cve@gitlab.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[11.2,18.7.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18.8,18.8.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18.9,18.9.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "GitLab", "source": "cna", "vendor": "GitLab"}, "product": "gitlab", "vendor": "gitlab"}], "analysis": {"en": {"generated_at": "2026-04-17T14:56:28.921193+00:00", "value": {"mitigation_remediation": ["Apply the recommended GitLab patch and upgrade to version 18.7.5, 18.8.5, 18.9.1 or newer.", "If upgrading immediately is not possible, disable or restrict access to the Bitbucket Server import endpoint to prevent resource exhaustion attacks.", "Configure or enable appropriate resource limits and throttling for import operations to mitigate future exploitation attempts."], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Affected products include GitLab Community Edition and Enterprise Edition. Vulnerable versions are all releases from 11.2 up to, but not including, 18.7.5; from 18.8.0 to 18.8.4; and the 18.9.0 release. The issue was fixed in GitLab 18.7.5, 18.8.5, and 18.9.1 respectively.", "description_and_impact": "The vulnerability arises from a lack of resource limits or throttling for an internal import endpoint. An attacker who authenticates to GitLab can repeatedly trigger the Bitbucket Server import feature with large responses, allowing them to exhaust memory or processing resources and bring the application to a halt.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation is unlikely at present. The vulnerability is not in the CISA KEV list. Exploitation requires valid user credentials and leverages the import endpoint to flood server resources. Administrators should therefore upgrade promptly or temporarily restrict that endpoint."}}}}, "created": "2026-02-26T13:14:47.600810+00:00", "updated": "2026-04-17T15:00:11.032402+00:00", "vendors": ["gitlab", "gitlab$PRODUCT$gitlab"]}