CVEvulnerability
CVE-2026-0958
7.5 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2026-02-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-436
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through memory or CPU exhaustion by bypassing JSON validation middleware limits.
Affected configurations
• gitlab gitlab (>= 18.4.0 < 18.6.6)
• gitlab gitlab (>= 18.7.0 < 18.7.4)
• gitlab gitlab (>= 18.8.0 < 18.8.4)
Related
Weakness · CWE (1)
- CWE-436 Interpretation Conflict weakness
References
- https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/ Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/586202 Broken Link, Issue Tracking
- https://hackerone.com/reports/3463363 Permissions Required