CVE-2026-1101
GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to cause denial of service to the GitLab instance due to improper input validation in GraphQL queries.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 0.41%
- CWE
- CWE-1284
- Published
- 2026-04-08
- Last modified
- 2026-04-10
Affected products
- GitLab GitLab
- GitLab GitLab
- GitLab GitLab
Weakness type
Related vulnerabilities
- CVE-2026-87735 — An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an...
- CVE-2026-87470 — Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36 allowed a...
- CVE-2026-16025 — Improper Payment Validation in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module
- CVE-2026-85201 — In Eclipse Ankaios versions 0.1.0 through 1.0.1, the agent does not limit the length declared by a...
- CVE-2026-82750 — Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation
- CVE-2026-82751 — Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning
- CVE-2026-82752 — Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length
- CVE-2026-53720 — pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small