CVE-2026-112212: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.4.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.5.1
Event History
Frequently Asked Questions
Which GitLab versions need remediation?
Affected versions are all releases from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. Upgrade to 19.3.6, 19.4.3, 19.5.1, or a later release in the applicable release line.
Does exploitation require an authenticated GitLab account?
No. Under the stated conditions, an unauthenticated user could poison a shared cache's OAuth/OIDC discovery document.
What is the practical impact of a successful attack?
A poisoned discovery document can cause certain OAuth/OIDC flows to redirect to an externally controlled server. The reported impacts include high confidentiality impact and low integrity and availability impact.