CVE-2026-1168: Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.1.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.2
Event History
Frequently Asked Questions
Which GitLab versions are affected?
Affected versions are GitLab CE/EE from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.
Does exploiting this issue require a GitLab account or user interaction?
No. The issue could allow an unauthenticated user to trigger denial of service under certain conditions, with no user interaction required.
What is the impact of successful exploitation?
Successful exploitation could cause a denial of service through improper resource allocation limits in GraphQL complexity calculation logic. The provided information does not indicate confidentiality or integrity impact.