CVE-2026-7427 PUBLISHED

Allocation of Resources Without Limits or Throttling in GitLab

Assigner: GitLab
Reserved: 29.04.2026 Published: 12.08.2026 Updated: 13.08.2026

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 5.3

Product Status

Vendor GitLab
Product GitLab
Versions Default: unaffected
  • affected from 18.5 to 19.0.6 (excl.)
  • affected from 19.1 to 19.1.4 (excl.)
  • affected from 19.2 to 19.2.2 (excl.)

Solutions

Upgrade to versions 19.0.6, 19.1.4, 19.2.2 or above.

Credits

  • Thanks [aphantom](https://hackerone.com/aphantom) for reporting this vulnerability through our HackerOne bug bounty program finder

References

Problem Types

  • CWE-770: Allocation of Resources Without Limits or Throttling CWE