CVE-2026-1659: GitLab CE/EE Denial of Service Vulnerability

CVE-2026-1659 Overview

CVE-2026-1659 is a denial of service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. An unauthenticated attacker can trigger the condition by sending specially crafted requests to a vulnerable GitLab instance. The root cause is insufficient input validation, classified under [CWE-770] Allocation of Resources Without Limits or Throttling. GitLab released patches on May 13, 2026 to address the issue.

Critical Impact

Unauthenticated remote attackers can exhaust resources on GitLab servers, disrupting source code management, CI/CD pipelines, and developer workflows for entire organizations.

Affected Products

• GitLab CE/EE versions 9.0 through 18.9.6
• GitLab CE/EE versions 18.10 through 18.10.5
• GitLab CE/EE versions 18.11 through 18.11.2

Discovery Timeline

• 2026-05-13 - GitLab releases patched versions 18.9.7, 18.10.6, and 18.11.3
• 2026-05-14 - CVE-2026-1659 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-1659

Vulnerability Analysis

The vulnerability allows an unauthenticated attacker to cause denial of service against GitLab CE/EE instances. The attack vector is network-based, requires low complexity, and needs neither privileges nor user interaction. The impact is limited to availability, with no confidentiality or integrity loss.

GitLab serves as a critical DevSecOps platform for many organizations. Disruption of a GitLab instance halts source control operations, blocks merge requests, and prevents continuous integration and continuous delivery (CI/CD) pipelines from executing. The unauthenticated nature of the attack expands the threat surface to any actor that can reach the GitLab web interface.

Root Cause

The root cause is insufficient input validation on request parameters processed by GitLab. The flaw maps to [CWE-770], which describes allocation of resources without limits or throttling. When a specially crafted request reaches the affected endpoint, the application consumes excessive resources rather than rejecting the malformed input. Repeated requests amplify resource consumption until the service becomes unresponsive.

Attack Vector

An unauthenticated attacker sends specially crafted HTTP requests to an exposed GitLab instance. No credentials, tokens, or prior access are required. The vulnerable code path fails to validate input boundaries, allowing the request to trigger disproportionate processing. Repeated submissions exhaust CPU, memory, or worker threads on the GitLab server, denying service to legitimate users.

Technical details of the affected endpoint and request structure are restricted in the GitLab HackerOne report and internal work item. See the GitLab Release Patch Notes and HackerOne Security Report #3519824 for additional context.

Detection Methods for CVE-2026-1659

Indicators of Compromise

• Sustained spikes in Puma or Sidekiq worker CPU and memory utilization without corresponding legitimate traffic increases.
• High volumes of HTTP requests from a single source or small set of sources to GitLab endpoints, followed by 502, 503, or timeout responses.
• Unexplained restarts of GitLab application services or web frontend processes.

Detection Strategies

• Monitor GitLab production.log and production_json.log for abnormal request patterns, oversized payloads, or repeated requests with similar parameter signatures.
• Inspect reverse proxy and load balancer logs (NGINX, HAProxy) for request floods preceding service degradation.
• Correlate web request telemetry with host-level resource metrics to identify request-driven exhaustion patterns.

Monitoring Recommendations

• Enable rate-limiting alerts at the web application firewall (WAF) or reverse proxy layer for unauthenticated endpoints.
• Track Prometheus metrics exported by GitLab, including request duration histograms and worker saturation, for sudden anomalies.
• Configure alerts on availability probes for /users/sign_in and other public endpoints to detect outages quickly.

How to Mitigate CVE-2026-1659

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.11.3, 18.10.6, or 18.9.7 as appropriate for your deployment branch.
• Restrict network access to self-managed GitLab instances using firewall rules or VPN gating where feasible.
• Review reverse proxy rate limiting and request size limits before broader exposure.

Patch Information

GitLab released fixed versions on May 13, 2026. Upgrade to GitLab 18.11.3, 18.10.6, or 18.9.7. Refer to the official GitLab Release Patch Notes for upgrade procedures and the GitLab Work Item #588201 for tracking details. GitLab.com has already been updated and requires no customer action.

Workarounds

• Apply aggressive rate limiting on the reverse proxy fronting GitLab to throttle unauthenticated request bursts.
• Limit maximum request body size at the NGINX or load balancer layer to reduce attack amplification.
• Place GitLab behind a WAF and block suspicious unauthenticated request patterns until patches are applied.