Denial of Service Vulnerability in GitLab CE/EE by Improper CSV Validation
CVE-2026-1403

6.5MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
7 October 2026

What is CVE-2026-1403?

A vulnerability in GitLab CE/EE allows authenticated users to exploit improper validation of CSV file structures during import operations. This issue can lead to a denial of service to Sidekiq workers, which are responsible for background job processing. All versions of GitLab CE/EE from 11.7 up to 18.8.9, as well as 18.9 before 18.9.5 and 18.10 before 18.10.3, are affected by this flaw. Remediation has been implemented in subsequent versions to address the CSV handling mechanism, enhancing the overall security posture of the platform.

Affected Version(s)

GitLab 11.7 < 18.8.9

GitLab 18.9 < 18.9.5

GitLab 18.10 < 18.10.3

References

https://hackerone.com/reports/3328937
technical-descriptionexploitpermissions-required
https://gitlab.com/gitlab-org/gitlab/-/work_items/587573

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [a92847865](https://hackerone.com/a92847865) for reporting this vulnerability through our HackerOne bug bounty program
.