{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1101", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-01-16T22:33:15.858Z", "datePublished": "2026-04-08T22:26:07.834Z", "dateUpdated": "2026-04-08T22:26:07.834Z"}, "containers": {"cna": {"title": "Improper Validation of Specified Quantity in Input in GitLab", "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to cause denial of service to the GitLab instance due to improper input validation in GraphQL queries."}], "affected": [{"vendor": "GitLab", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "versions": [{"version": "18.2", "status": "affected", "lessThan": "18.8.9", "versionType": "semver"}, {"version": "18.9", "status": "affected", "lessThan": "18.9.5", "versionType": "semver"}, {"version": "18.10", "status": "affected", "lessThan": "18.10.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-1284: Improper Validation of Specified Quantity in Input", "cweId": "CWE-1284", "type": "CWE"}]}], "references": [{"url": "https://hackerone.com/reports/3460228", "name": "HackerOne Bug Bounty Report #3460228", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/586488"}, {"url": "https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.8.9, 18.9.5, 18.10.3 or above."}], "credits": [{"lang": "en", "value": "Thanks [sim4n6](https://hackerone.com/sim4n6) for reporting this vulnerability through our HackerOne bug bounty program", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-04-08T22:26:07.834Z"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to cause denial of service to the GitLab instance due to improper input validation in GraphQL queries."}], "id": "CVE-2026-1101", "lastModified": "2026-04-08T23:16:57.667", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "cve@gitlab.com", "type": "Secondary"}]}, "published": "2026-04-08T23:16:57.667", "references": [{"source": "cve@gitlab.com", "url": "https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/"}, {"source": "cve@gitlab.com", "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/586488"}, {"source": "cve@gitlab.com", "url": "https://hackerone.com/reports/3460228"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1284"}], "source": "cve@gitlab.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18.2,18.8.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18.9,18.9.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18.10,18.10.3)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "GitLab", "source": "cna", "vendor": "GitLab"}, "product": "gitlab", "vendor": "gitlab"}], "analysis": {"en": {"generated_at": "2026-04-08T23:22:05.238197+00:00", "value": {"mitigation_remediation": ["Upgrade GitLab to the latest supported Enterprise Edition release (18.8.9, 18.9.5, 18.10.3, or newer).", "If an upgrade is not immediately possible, restrict authenticated users from sending arbitrary GraphQL queries until a patch is applied.", "Monitor GitLab for abnormal resource usage indicative of exploitation."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "GitLab EE instances running any version from 18.2 up to, but not including, 18.8.9; 18.9 up to, but not including, 18.9.5; and 18.10 up to, but not including, 18.10.3 are affected. These versions were released before the 2026\u201104\u201108 patch release that includes the fix.", "description_and_impact": "The vulnerability lies in insufficient validation of the quantity parameter within GraphQL queries in GitLab Enterprise Edition. An authenticated attacker can exploit this flaw by submitting a malformed quantity value that causes the GitLab application to consume excessive resources or hang, leading to a denial of service for all users. The weakness is classified as improper input validation (CWE\u20111284).", "risk_and_exploitability": "The CVSS base score of 6.5 indicates a medium severity issue. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires that the attacker be authenticated within the GitLab system, and they must be able to send arbitrary GraphQL queries. Once conditions are met, exploitation can flood the GitLab backend or exhaust its processing resources, potentially bringing the instance to a halt. Because the vector is internal and requires authentication, the likelihood of widespread exploitation is moderate, but any compromised or overly privileged user could trigger the denial of service immediately."}}}}, "created": "2026-04-09T08:16:09.568248+00:00", "updated": "2026-04-09T08:25:35.535604+00:00", "vendors": ["gitlab", "gitlab$PRODUCT$gitlab"]}