CVE-2026-1168 Overview
GitLab has patched a denial of service vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw resides in the GraphQL complexity calculation logic and stems from improper resource allocation limits [CWE-770]. Under certain conditions, an unauthenticated attacker can exhaust server resources by sending crafted GraphQL queries over the network. Affected releases include all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. The issue does not impact confidentiality or integrity but degrades availability of the GitLab instance for legitimate users.
Critical Impact
Unauthenticated network attackers can trigger denial of service against GitLab CE/EE instances by abusing GraphQL complexity calculation.
Affected Products
- GitLab CE/EE versions 18.4.6 through 19.1.7
- GitLab CE/EE 19.2 through 19.2.5
- GitLab CE/EE 19.3 through 19.3.1
Discovery Timeline
- 2026-09-16 - CVE-2026-1168 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-1168
Vulnerability Analysis
The vulnerability is a GraphQL API flaw classified as Allocation of Resources Without Limits or Throttling [CWE-770]. GitLab's GraphQL endpoint enforces a query complexity budget to prevent expensive operations. The complexity calculation logic fails to correctly account for certain query structures. Attackers can craft queries that bypass or miscalculate the complexity score, allowing operations that consume disproportionate CPU and memory. Repeated submission of such queries exhausts backend resources and renders the GitLab instance unresponsive.
Root Cause
The root cause is improper enforcement of resource allocation limits inside the GraphQL complexity calculation path. Specific query patterns evade the complexity ceiling, so the resolver executes work that should have been rejected. This is a classic algorithmic complexity issue where query cost estimation diverges from actual runtime cost.
Attack Vector
The attack requires only network access to the GitLab GraphQL endpoint, typically /api/graphql. No authentication or user interaction is needed. An attacker sends malformed or deeply nested GraphQL queries whose true execution cost exceeds the calculated complexity budget. Sustained submission drives sustained CPU and memory pressure on the Rails and Sidekiq workers backing the GitLab instance.
See GitLab Patch Release 19.3.2, GitLab Work Item #586586, and HackerOne Report #3461590 for additional technical context.
Detection Methods for CVE-2026-1168
Indicators of Compromise
- Spikes in POST requests to /api/graphql from unauthenticated sources or single IP addresses
- Sustained high CPU or memory usage on GitLab Rails workers with no corresponding legitimate workload
- GraphQL queries with unusually deep nesting, large field selections, or repeated fragments
- Increased HTTP 5xx responses and elevated request latency across the GitLab web tier
Detection Strategies
- Enable GitLab's GraphQL request logging and inspect graphql_json.log for anomalous query size and depth
- Correlate application logs with reverse proxy access logs to identify unauthenticated GraphQL abuse
- Alert on repeated GraphQL requests exceeding baseline complexity or payload size thresholds
Monitoring Recommendations
- Track request rate and response time on the /api/graphql endpoint through your reverse proxy or WAF
- Monitor Rails worker saturation, Puma queue depth, and Sidekiq latency for early signs of resource exhaustion
- Forward GitLab application and web logs to a centralized analytics platform to baseline GraphQL usage
How to Mitigate CVE-2026-1168
Immediate Actions Required
- Upgrade GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 depending on your release track
- Restrict network exposure of /api/graphql to trusted networks or authenticated users where feasible
- Deploy rate limiting on the GraphQL endpoint at the reverse proxy or WAF layer
- Review recent GraphQL logs for signs of abuse prior to patching
Patch Information
GitLab addressed the vulnerability in the 19.3.2 patch release, along with backports to 19.2.6 and 19.1.8. Administrators running any affected version should upgrade immediately using the standard GitLab package manager or Omnibus upgrade procedure. Full release details are documented in the GitLab Patch Release 19.3.2 advisory.
Workarounds
- Apply strict rate limiting on /api/graphql at the load balancer, NGINX, or WAF layer
- Block unauthenticated GraphQL requests at the network edge until the patch is deployed
- Reduce GitLab's configured GraphQL request timeout and maximum query complexity where operationally acceptable
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
