CVE-2026-1101
Received
Received - Intake
GraphQL Injection in GitLab EE Causes Denial of Service
Vulnerability report for CVE-2026-1101, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-04-08
Last updated on: 2026-04-14
Assigner: GitLab Inc.
Description
Description
GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to cause denial of service to the GitLab instance due to improper input validation in GraphQL queries.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab | From 18.2 (inc) to 18.8.9 (exc) |
| gitlab | gitlab | From 18.9.0 (inc) to 18.9.5 (exc) |
| gitlab | gitlab | From 18.10.0 (inc) to 18.10.3 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-1284 | The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. |
