CVE-2026-3988: Inefficient Algorithmic Complexity in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance unresponsive due to improper input validation in GraphQL request processing.
Other sources
GitLab has remediated an issue that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance unresponsive due to improper input validation in GraphQL request processing.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2026-3988?
CVE-2026-3988 is classified as a denial of service vulnerability impacting GitLab.
How do I fix CVE-2026-3988?
To remediate CVE-2026-3988, upgrade to GitLab versions 18.8.7, 18.9.3, or 18.10.1.
Which versions of GitLab are affected by CVE-2026-3988?
GitLab versions from 18.5 to 18.8.6, 18.9.0 to 18.9.2, and 18.10.0 are affected by CVE-2026-3988.
Can CVE-2026-3988 be exploited by authenticated users?
CVE-2026-3988 can be exploited by unauthenticated users through improper input validation.
What is the impact of CVE-2026-3988 on GitLab instances?
CVE-2026-3988 may render GitLab instances unresponsive, leading to service denial.