CVE-2026-77801 GitLab CVE debrief

Who should care

GitLab CE/EE administrators and users with low privileges who could potentially exploit this vulnerability should be aware of the issue and take steps to remediate it. Security teams and vulnerability management teams should also review the vulnerability and implement compensating controls where necessary.

Technical summary

CVE-2026-77801 is a denial of service vulnerability in GitLab CE/EE affecting versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1. The issue, caused by missing object count limits, could allow an authenticated user with low privileges to cause denial of service affecting background job processing. This vulnerability can be mitigated by applying patches or updates to affected versions.

Defensive priority

Authenticated users with low privileges could potentially cause denial of service affecting background job processing in GitLab CE/EE versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 due to missing object count limits.

Recommended defensive actions

• Inventory and verify affected GitLab CE/EE versions, applying vendor patches or updates to remediate the vulnerability.
• Implement compensating controls such as monitoring background job processing for anomalies.
• Enforce strict access controls and authentication mechanisms.
• Review and update incident response plans to include denial of service scenarios.
• Conduct regular vulnerability assessments to identify potential exposures.
• Verify patch deployment and validate remediation through testing.

Evidence notes

The CVE-2026-77801 issue was remediated by GitLab in versions 19.1.7, 19.2.5, and 19.3.1. Affected versions include 12.8 through 19.1.6, 19.2 through 19.2.4, and 19.3.0. The issue allowed authenticated users to cause denial of service affecting background job processing due to missing object count limits. Evidence of exposure should be verified through monitoring background job processing for anomalies.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.