CVE-2026-1725: Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting versions from 18.9 before 18.9.1 that could have under certain conditions, allowed an unauthenticated user to cause denial of service by sending specially crafted requests to a CI jobs API endpoint.
Other sources
GitLab has remediated an issue that could have under certain conditions, allowed an unauthenticated user to cause denial of service by sending specially crafted requests to a CI jobs API endpoint.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-1725?
CVE-2026-1725 is classified as a Denial of Service vulnerability affecting GitLab CE/EE.
How do I fix CVE-2026-1725?
To remediate CVE-2026-1725, upgrade GitLab CE/EE to version 18.9.1 or later.
Which versions of GitLab are affected by CVE-2026-1725?
CVE-2026-1725 affects GitLab CE/EE versions from 18.9 before 18.9.1.
Can an unauthenticated user exploit CVE-2026-1725?
Yes, an unauthenticated user can exploit CVE-2026-1725 to cause a denial of service.
What type of vulnerability is CVE-2026-1725?
CVE-2026-1725 is identified as a Denial of Service issue in the token decoder.