CVE-2026-77801

Published Aug 26, 2026

Last updated 4 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-77801 is a denial-of-service vulnerability identified in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw stems from a lack of object count limits, which allows an authenticated user to disrupt background job processing. This can lead to resource exhaustion, thereby degrading or halting asynchronous operations across the GitLab instance. The vulnerability affects GitLab CE/EE versions 12.8 through 19.1.6, 19.2 through 19.2.4, and version 19.3.0. GitLab has since released patched versions (19.1.7, 19.2.5, and 19.3.1) to address this issue.

Description: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing object count limits.
Source: cve@gitlab.com
NVD status: Analyzed
Products: gitlab

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM

Weaknesses

cve@gitlab.com: CWE-770

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "2A618F68-6664-43F3-8FE7-E295B2806FA9",
            "versionEndExcluding": "19.1.7",
            "versionStartIncluding": "12.8.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "92B66601-A77F-4799-92D5-48D3EEC310C9",
            "versionEndExcluding": "19.1.7",
            "versionStartIncluding": "12.8.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
            "matchCriteriaId": "4AC029F1-AA9C-422B-AD0C-3A01C0CF2EFA",
            "versionEndExcluding": "19.2.5",
            "versionStartIncluding": "19.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "80975E60-F9E7-41D6-A1CA-384E3CA3964D",
            "versionEndExcluding": "19.2.5",
            "versionStartIncluding": "19.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:19.3.0:*:*:*:community:*:*:*",
            "matchCriteriaId": "D213E25A-F86A-47DA-ADE9-8CA1A57DCE08",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:gitlab:gitlab:19.3.0:*:*:*:enterprise:*:*:*",
            "matchCriteriaId": "99734371-8B08-4207-88EB-D23AE5608E9D",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.