CVE-2026-15975: GitLab CE/EE DoS Vulnerability

CVE-2026-15975 Overview

CVE-2026-15975 is a denial-of-service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from insufficient resource throttling when processing merge request discussions. Under certain conditions, an unauthenticated attacker can exhaust server resources by sending crafted requests over the network. GitLab has remediated the issue in patched releases across the affected version ranges. The weakness is categorized under CWE-770 (Allocation of Resources Without Limits or Throttling).

Critical Impact
An unauthenticated remote attacker can trigger a denial-of-service condition against GitLab instances, disrupting availability of source code management, CI/CD pipelines, and developer workflows for the entire organization.

Affected Products

GitLab CE/EE versions 11.8 up to but not including 19.0.5
GitLab CE/EE versions 19.1 up to but not including 19.1.3
GitLab CE/EE versions 19.2 up to but not including 19.2.1

Discovery Timeline

2026-07-29 - CVE-2026-15975 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-15975

Vulnerability Analysis

The vulnerability resides in the merge request discussion processing logic within GitLab CE/EE. GitLab fails to apply adequate rate limiting or resource caps when handling certain discussion-related operations. An unauthenticated attacker can leverage this gap to force the server to consume excessive CPU, memory, or I/O resources. Sustained abuse degrades availability for legitimate users and can render the GitLab instance unresponsive.

The issue is classified as CWE-770, indicating that the application allocates resources without enforcing appropriate limits. The EPSS score is 0.394%, placing it in the 32nd percentile for likelihood of near-term exploitation. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

GitLab's merge request discussion endpoint does not enforce sufficient throttling on unauthenticated request paths. Under specific conditions described in the vendor advisory, the endpoint accepts and processes requests that trigger expensive backend operations without corresponding rate or resource controls. See the GitLab Work Item Overview for vendor-tracked details.

Attack Vector

An attacker sends crafted network requests to a vulnerable GitLab instance's merge request discussion endpoints. No authentication or user interaction is required. The attack requires only network reachability to the target GitLab server. Repeated or concurrent requests amplify the resource consumption and produce a denial-of-service condition affecting all users of the instance.

No verified exploitation code is publicly available. See the GitLab Patch Release Notes for the official remediation details.

Detection Methods for CVE-2026-15975

Indicators of Compromise

Sudden spikes in CPU, memory, or database load on GitLab application and Sidekiq worker nodes without corresponding legitimate traffic patterns.
High volumes of unauthenticated HTTP requests to merge request discussion endpoints from a small set of source IP addresses.
Elevated response times or HTTP 5xx errors from the GitLab web application during unauthenticated request surges.

Detection Strategies

Monitor GitLab production logs (production.log, api_json.log) for anomalous request rates targeting merge request discussion routes.
Correlate reverse proxy or load balancer access logs to identify unauthenticated request bursts against /merge_requests/ discussion paths.
Baseline normal Sidekiq queue depth and alert on sustained deviations that align with external request spikes.

Monitoring Recommendations

Enable and tune GitLab's built-in application rate limits and log all throttled requests for review.
Forward GitLab application, Nginx, and Sidekiq telemetry to a centralized SIEM for cross-source correlation.
Alert on repeated unauthenticated access to merge request endpoints from single source IPs or narrow IP ranges.

How to Mitigate CVE-2026-15975

Immediate Actions Required

Upgrade GitLab CE/EE to version 19.0.5, 19.1.3, or 19.2.1 or later depending on your current release track.
Restrict network exposure of GitLab instances so that only trusted networks or authenticated reverse proxies can reach merge request endpoints.
Review recent access logs for unauthenticated request bursts against merge request discussion routes and block offending source IPs.

Patch Information

GitLab has released fixed versions 19.0.5, 19.1.3, and 19.2.1 that remediate the insufficient resource throttling in merge request discussion processing. Administrators should follow the standard GitLab upgrade path documented in the GitLab Patch Release Notes. Self-managed instances on affected versions from 11.8 onward must upgrade to an appropriate fixed release.

Workarounds

Place GitLab behind a web application firewall (WAF) or reverse proxy configured to rate-limit unauthenticated requests to merge request discussion endpoints.
Enforce network-level access controls to restrict anonymous access to the GitLab web interface until patches are applied.
Increase monitoring sensitivity for GitLab application resource utilization and configure automated alerts for sustained anomalies.

bash

# Example Nginx rate-limit snippet for unauthenticated GitLab requests
limit_req_zone $binary_remote_addr zone=gitlab_mr:10m rate=10r/s;

server {
    location ~ ^/.*/-/merge_requests/.*/discussions {
        limit_req zone=gitlab_mr burst=20 nodelay;
        proxy_pass http://gitlab_upstream;
    }
}