PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-1402 GitLab CVE debrief

GitLab has remediated a denial-of-service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The issue, assigned CVSS 3.1 score 6.5 (Medium), stems from insufficient validation that could allow an authenticated user to cause denial of service under certain conditions. The vulnerability affects all versions from 17.1 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1. GitLab released patches on May 27, 2026. The weakness is categorized as CWE-770 (Allocation of Resources Without Limits or Throttling). No known exploitation in ransomware campaigns has been reported, and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
GitLab
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running self-managed GitLab CE/EE instances, particularly those with large user bases or public-facing installations where authenticated access is broadly available. DevOps teams and platform engineers responsible for GitLab infrastructure availability should prioritize patching to prevent service disruption.

Technical summary

This vulnerability in GitLab CE/EE allows authenticated users to trigger denial of service through insufficient validation of user-controlled input or operations. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates a network-accessible attack with low complexity, requiring authenticated access but no user interaction, resulting in high availability impact. The root cause is classified under CWE-770, suggesting inadequate resource allocation limits or throttling mechanisms. Affected versions span multiple release branches from 17.1 through 19.0.0, with comprehensive patches released across all supported minor versions.

Defensive priority

medium

Recommended defensive actions

  • Upgrade GitLab CE/EE to version 18.10.7, 18.11.4, or 19.0.1 or later, depending on your current major version branch.
  • If immediate patching is not feasible, review and restrict authenticated user permissions where possible to reduce attack surface.
  • Monitor GitLab instance performance and resource utilization for signs of anomalous consumption that may indicate exploitation attempts.
  • Review HackerOne report 3517283 for technical details if you have appropriate access permissions.

Evidence notes

The CVE description and affected version ranges are sourced from NVD CPE criteria and GitLab's official release notes. CVSS vector confirms network attack vector with low attack complexity, requiring low privileges and no user interaction, with high availability impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-1402 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-1402

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-1402 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-1402

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.