Denial of Service Vulnerability in GitLab CE/EE Affecting Multiple Versions
CVE-2026-1660

6.5MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
22 April 2026

What is CVE-2026-1660?

A denial of service vulnerability was discovered in GitLab CE/EE, which affects several versions of the software. This issue arises from inadequate input validation during the issue import process. When exploited, it allows an authenticated user to manipulate the system in such a way that it could result in service disruption. GitLab has since released patches between versions to address this vulnerability and enhance the security framework.

Affected Version(s)

GitLab 12.3 < 18.9.6

GitLab 18.10 < 18.10.4

GitLab 18.11 < 18.11.1

References

https://hackerone.com/reports/3518743
technical-descriptionexploitpermissions-required
https://gitlab.com/gitlab-org/gitlab/-/work_items/588200
https://about.gitlab.com/releases/2026/04/22/patch-releas...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [a92847865](https://hackerone.com/a92847865) for reporting this vulnerability through our HackerOne bug bounty program
.