CVE-2026-77801 Overview
CVE-2026-77801 is a denial of service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from missing object count limits, which an authenticated user can abuse to disrupt background job processing. The issue affects all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1. GitLab has released patched versions to remediate the issue. The vulnerability is categorized under [CWE-770] Allocation of Resources Without Limits or Throttling.
Critical Impact
An authenticated attacker can trigger resource exhaustion in background job processing, degrading or halting asynchronous operations across the GitLab instance.
Affected Products
- GitLab CE/EE versions 12.8 through 19.1.6
- GitLab CE/EE versions 19.2 through 19.2.4
- GitLab CE/EE version 19.3.0
Discovery Timeline
- 2026-08-26 - CVE-2026-77801 published to the National Vulnerability Database
- 2026-08-26 - Last updated in the NVD database
Technical Details for CVE-2026-77801
Vulnerability Analysis
The vulnerability resides in GitLab's handling of user-submitted objects processed by background workers. GitLab uses Sidekiq for asynchronous job processing, including CI/CD pipelines, notifications, repository operations, and housekeeping tasks. Without object count limits, an authenticated user can submit requests that generate excessive numbers of background jobs or objects. This saturates the job queue and consumes worker capacity, blocking legitimate operations. The vulnerability requires only low-privileged authenticated access, making any user account a potential vector. Because the impact targets availability, exploitation degrades platform reliability without exposing or altering data.
Root Cause
The root cause is the absence of enforced upper bounds on object counts in specific request-handling paths. The application code does not validate or cap the number of items processed per request before enqueueing associated background jobs. This maps directly to [CWE-770] Allocation of Resources Without Limits or Throttling. GitLab's remediation, documented in GitLab Work Item 597273, introduces server-side count limits.
Attack Vector
Exploitation occurs remotely over the network against an authenticated GitLab session. An attacker with a valid account submits crafted requests containing large object collections. The server accepts the input and enqueues corresponding background jobs, exhausting Sidekiq worker capacity. Legitimate jobs stall or fail, producing a denial of service condition. No user interaction or elevated privileges are required beyond a standard authenticated session. Refer to the GitLab Patch Release Notes for the vendor's technical description.
Detection Methods for CVE-2026-77801
Indicators of Compromise
- Sustained backlog growth in Sidekiq queues without corresponding legitimate workload increases
- Unusually large request payloads originating from a single authenticated user or API token
- Elevated response latency for GitLab API endpoints tied to background job dispatch
- Repeated failures or timeouts in scheduled CI/CD pipelines and repository operations
Detection Strategies
- Correlate authenticated API request volumes with Sidekiq queue depth metrics to identify abusive patterns
- Alert on requests containing object arrays that exceed historical baselines for a given endpoint
- Monitor production_json.log and api_json.log for high-frequency requests from individual user IDs
- Track worker starvation and job retry counts through GitLab's Prometheus metrics endpoint
Monitoring Recommendations
- Ingest GitLab application, API, and Sidekiq logs into a centralized analytics platform for correlation
- Establish baselines for background job throughput and configure anomaly detection on deviations
- Review audit logs for accounts submitting atypical bulk operations shortly after authentication
How to Mitigate CVE-2026-77801
Immediate Actions Required
- Upgrade to GitLab CE/EE 19.1.7, 19.2.5, or 19.3.1, matching your current major version branch
- Audit recent authenticated activity for signs of queue saturation or abusive bulk submissions
- Restrict account creation and enforce strong authentication to reduce the pool of potential abusers
- Apply rate limiting at the reverse proxy or API gateway for endpoints that generate background jobs
Patch Information
GitLab addressed the vulnerability in versions 19.1.7, 19.2.5, and 19.3.1. Administrators should follow the upgrade guidance published in the GitLab Patch Release Notes. The fix introduces object count limits on the affected code paths, as tracked in GitLab Work Item 597273.
Workarounds
- Enforce GitLab's built-in application rate limits for authenticated API requests until patching is complete
- Scale Sidekiq worker capacity temporarily to absorb load while investigating suspicious activity
- Disable or restrict access to non-essential API endpoints associated with bulk object submissions
# Example: enable and tune GitLab application rate limits via gitlab.rb
# Then reconfigure: sudo gitlab-ctl reconfigure
gitlab_rails['rate_limit_requests_per_period'] = 300
gitlab_rails['rate_limit_period'] = 60
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
