CVE-2026-8280: Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user to cause denial of service through excessive memory consumption due to improper input validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.9.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.10.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.11.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8280?
CVE-2026-8280 has been classified as a high severity vulnerability due to its potential to cause denial of service.
What versions of GitLab are affected by CVE-2026-8280?
CVE-2026-8280 affects GitLab CE/EE versions from 8.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3.
How do I fix CVE-2026-8280?
To remediate CVE-2026-8280, upgrade your GitLab instance to versions 18.9.7, 18.10.6, or 18.11.3 or later.
What type of attack does CVE-2026-8280 allow?
CVE-2026-8280 allows an authenticated user to execute a denial of service attack through excessive resource consumption.
Is there a workaround for CVE-2026-8280?
There are no official workarounds for CVE-2026-8280, and it's recommended to apply the available patches as soon as possible.