CVE-2026-2845: Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an authenticated user to cause denial of service by exploiting a Bitbucket Server import endpoint via repeatedly sending large responses.
Other sources
GitLab has remediated an issue that could have allowed an authenticated user to cause denial of service by exploiting a Bitbucket Server import endpoint via repeatedly sending large responses.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-2845?
CVE-2026-2845 is rated as a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2026-2845?
To fix CVE-2026-2845, upgrade GitLab to version 18.7.5, 18.8.5, or 18.9.1 or later.
Which versions are affected by CVE-2026-2845?
CVE-2026-2845 affects GitLab versions from 11.2 up to but not including 18.7.5, 18.8 up to but not including 18.8.5, and 18.9 up to but not including 18.9.1.
Who can be impacted by CVE-2026-2845?
Authenticated users of GitLab CE/EE can be impacted by CVE-2026-2845 through potential denial of service.
What type of vulnerability is CVE-2026-2845?
CVE-2026-2845 is a missing rate limit vulnerability that can be exploited within Bitbucket Server imports.