CVE-2026-1102: GitLab SSH Authentication DoS Vulnerability

CVE-2026-1102 Overview

CVE-2026-1102 is a denial of service vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw allows an unauthenticated remote attacker to exhaust server resources by sending repeated malformed SSH authentication requests. The issue impacts all versions from 12.3 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2. GitLab classified the weakness under CWE-770 (Allocation of Resources Without Limits or Throttling). Because the vulnerability requires no authentication and no user interaction, any internet-exposed GitLab instance is reachable by an attacker on the network.

Critical Impact
Unauthenticated attackers can disrupt GitLab availability by flooding the SSH endpoint with malformed authentication requests, breaking CI/CD pipelines and developer workflows.

Affected Products

GitLab Community Edition (CE) versions 12.3 through 18.6.3
GitLab Enterprise Edition (EE) versions 18.7 before 18.7.2
GitLab Community and Enterprise Edition versions 18.8 before 18.8.2

Discovery Timeline

2026-01-21 - GitLab releases patched versions 18.8.2, 18.7.2, and 18.6.4
2026-01-22 - CVE-2026-1102 published to NVD
2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-1102

Vulnerability Analysis

The vulnerability resides in the SSH authentication handling path of GitLab CE/EE. GitLab Shell processes SSH connection requests on behalf of the Rails application to authenticate Git operations over SSH. When a client sends a malformed authentication request, the server fails to bound the resources consumed during request processing. An attacker who repeatedly sends such requests forces the GitLab instance to allocate connection state, processing threads, or memory without sufficient throttling.

The attacker does not need credentials, a valid SSH key, or any prior interaction with the target. Network reachability to the SSH service port is the only prerequisite. GitLab tracked the underlying defect in GitLab Issue #579746.

Root Cause

The root cause is unbounded resource allocation in the SSH authentication code path [CWE-770]. The service accepts and begins processing malformed authentication payloads without rate limiting, request validation throttling, or per-source quota enforcement. Repeated malformed requests therefore consume CPU, memory, and connection slots until legitimate Git SSH operations fail.

Attack Vector

The attack vector is the network. An attacker connects to the GitLab SSH endpoint, typically TCP port 22 or 2222, and issues a stream of malformed authentication requests. The vulnerability requires no authentication, no privileges, and no user interaction. The result is loss of availability for Git operations, CI/CD jobs, and any service that depends on SSH-based repository access. Confidentiality and integrity are not impacted.

No public proof-of-concept exploit is currently available for CVE-2026-1102, and CISA has not added the entry to the Known Exploited Vulnerabilities catalog. Full technical details are documented in the GitLab Patch Release 18.8.2 advisory.

Detection Methods for CVE-2026-1102

Indicators of Compromise

High volume of inbound SSH connections from a small number of source IP addresses to the GitLab server
Spikes in GitLab Shell process count, CPU utilization, or memory consumption without a corresponding increase in legitimate Git activity
Repeated SSH authentication failures logged in gitlab-shell.log or auth.log from the same source
Degraded responsiveness of git clone, git push, and git pull operations over SSH

Detection Strategies

Monitor connection rates to TCP port 22 (or the custom GitLab SSH port) and alert on thresholds exceeding baseline
Correlate SSH authentication failures from a single source IP within a short time window using SIEM rules
Inspect GitLab Shell and sshd logs for malformed protocol messages and truncated handshakes
Track GitLab application metrics for queue depth and worker saturation tied to SSH-originated requests

Monitoring Recommendations

Forward gitlab-shell.log, sshd logs, and GitLab Workhorse metrics to a centralized analytics platform
Establish baselines for SSH connection volume per source and alert on statistically significant deviations
Track availability of Git SSH operations with synthetic transactions from monitoring probes
Review network flow data for sustained TCP/22 traffic from non-developer source ranges

How to Mitigate CVE-2026-1102

Immediate Actions Required

Upgrade GitLab CE/EE to version 18.8.2, 18.7.2, or 18.6.4 depending on your installed branch
Restrict network access to the GitLab SSH port using firewall rules or security groups so only trusted CIDRs can reach it
Enable rate limiting at the load balancer or reverse proxy in front of GitLab to cap connections per source IP
Audit recent SSH logs for evidence of malformed authentication floods prior to patching

Patch Information

GitLab released fixed versions on January 21, 2026. Administrators must install GitLab 18.8.2, 18.7.2, or 18.6.4, which contain the remediation. See the GitLab Patch Release 18.8.2 announcement for upgrade instructions and verification steps. GitLab.com SaaS tenants are already running the patched code.

Workarounds

Place the GitLab SSH endpoint behind a network access control list that permits only known developer and CI runner ranges
Deploy fail2ban or equivalent to ban source IPs generating repeated SSH authentication failures
Use a reverse proxy or SSH bastion that enforces connection rate limits before traffic reaches GitLab Shell
Temporarily disable SSH-based Git access and require HTTPS clone URLs if patching cannot occur immediately

bash

# Example fail2ban jail to throttle SSH abuse against GitLab
# /etc/fail2ban/jail.d/gitlab-sshd.conf
[gitlab-sshd]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 5
findtime = 60
bantime  = 3600