MEDIUM

CVE-2026-1660

Gitlab GitLab 2026-04-22 CVSS v3.1

CVSS

6.5

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to cause denial of service when importing issues due to improper input validation.

Summary dbcve.org

GitLab CE/EE versions 12.3 through 18.11.x contained an input validation flaw in the issue import feature that allowed authenticated users to trigger denial of service conditions via specially crafted import requests.

Mitigation

Upgrade GitLab to version 18.9.6, 18.10.4, 18.11.1 or later to receive the patched input validation logic.

Weakness (CWE)

CWE-770 Resource Allocation Without Limits

EPSS Score

0.4%

Probability of exploitation in next 30 days

34.2th percentile

References

https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/work_items/588200 Broken Link https://hackerone.com/reports/3518743 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE