CVE-2026-1402: GitLab Denial of Service Vulnerability

CVE-2026-1402 Overview

CVE-2026-1402 is a denial-of-service vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from insufficient input validation and is tracked under CWE-770: Allocation of Resources Without Limits or Throttling. An authenticated user can exploit the issue under certain conditions to disrupt availability of the GitLab service. GitLab has remediated the issue across multiple supported branches and published a coordinated patch release.

Critical Impact

An authenticated attacker can trigger denial-of-service conditions against GitLab CE/EE instances, impacting availability for all users of the platform.

Affected Products

• GitLab CE/EE versions 17.1 through versions before 18.10.7
• GitLab CE/EE versions 18.11 through versions before 18.11.4
• GitLab CE/EE versions 19.0 before 19.0.1

Discovery Timeline

• 2026-05-27 - CVE-2026-1402 published to NVD
• 2026-05-27 - GitLab releases patch versions 18.10.7, 18.11.4, and 19.0.1
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-1402

Vulnerability Analysis

The vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling. GitLab fails to adequately validate certain user-supplied input, allowing an authenticated user to consume excessive server resources. The result is a denial-of-service condition affecting the availability of the GitLab instance.

The attack requires network access and valid authentication to the GitLab instance. No user interaction is needed once the attacker holds valid credentials. Confidentiality and integrity of data are not affected — only availability is impacted.

Root Cause

The root cause is insufficient validation of input handled by a GitLab component. Without proper bounds or throttling, the affected code path permits resource exhaustion. Details of the specific component are tracked in GitLab Work Item #587569 and the corresponding HackerOne Report #3517283.

Attack Vector

A remote, authenticated attacker submits crafted requests to a vulnerable GitLab endpoint over the network. Under the specific conditions described in the advisory, those requests cause excessive resource consumption on the server. Sustained exploitation degrades or interrupts service for legitimate users.

No verified public proof-of-concept code is available. See the GitLab Patch Release Announcement for vendor-confirmed technical context.

Detection Methods for CVE-2026-1402

Indicators of Compromise

• Unusual spikes in CPU, memory, or worker queue utilization on GitLab application or Sidekiq nodes
• Repeated requests from a single authenticated user account to the same endpoint in short windows
• Increased rates of 5xx HTTP responses or request timeouts in GitLab production.log and production_json.log
• Sidekiq job backlogs or worker restarts coinciding with authenticated user activity

Detection Strategies

• Audit GitLab application logs for high-frequency authenticated requests from individual users or tokens
• Correlate authenticated API and web traffic against GitLab process resource metrics to identify abusive patterns
• Monitor personal access token and OAuth token usage for anomalous request volumes

Monitoring Recommendations

• Enable and review GitLab audit events for authenticated activity originating from non-standard IP ranges
• Forward GitLab logs and metrics to a centralized SIEM or data lake for behavioral baselining
• Configure alerts on sustained resource saturation and failed health checks on GitLab nodes

How to Mitigate CVE-2026-1402

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.10.7, 18.11.4, or 19.0.1 based on your current major branch
• Review authenticated user activity and revoke tokens or accounts exhibiting abusive request patterns
• Apply rate limiting to authenticated API and web endpoints as defense-in-depth

Patch Information

GitLab released fixed versions 18.10.7, 18.11.4, and 19.0.1 on 2026-05-27. Administrators should follow the upgrade path documented in the GitLab Patch Release Announcement. GitLab.com SaaS tenants run the patched version; self-managed instances must be updated manually.

Workarounds

• Restrict GitLab access to trusted networks via reverse proxy or firewall rules until patching is complete
• Tighten existing GitLab application and user rate limits in the Admin Area under Settings > Network
• Temporarily disable or reduce permissions for user accounts not required for active development workflows

# Verify the installed GitLab version after upgrade
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Example: enable user and IP rate limiting via gitlab.rb
sudo editor /etc/gitlab/gitlab.rb
# gitlab_rails['rate_limit_requests_per_period'] = 300
# gitlab_rails['rate_limit_period'] = 60
sudo gitlab-ctl reconfigure