CVE-2026-1387: Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to cause Denial of Service by uploading a malicious file and repeatedly querying it through GraphQl.
Other sources
GitLab has remediated an issue that could have allowed an authenticated user to cause denial of service by uploading a specially crafted file to the dashboard and repeatedly sending GraphQL queries to parse it.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-1387?
CVE-2026-1387 is classified as a Denial of Service vulnerability affecting GitLab EE.
How do I fix CVE-2026-1387?
To fix CVE-2026-1387, upgrade to GitLab EE versions 18.6.6, 18.7.4, or 18.8.4.
Which versions of GitLab EE are affected by CVE-2026-1387?
CVE-2026-1387 affects all GitLab EE versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4.
Who can exploit CVE-2026-1387?
An authenticated user can exploit CVE-2026-1387 by uploading a malicious file to cause a Denial of Service.
What impact does CVE-2026-1387 have on GitLab EE systems?
CVE-2026-1387 can lead to a Denial of Service condition, disrupting the availability of GitLab EE services.