CVE-2026-7250
Received
Received - Intake
Denial of Service in GitLab CE/EE via API Request Parsing
Publication date: 2026-06-11
Last updated on: 2026-06-11
Assigner: GitLab Inc.
Description
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper input validation in the API request parsing middleware.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab_ce | From 12.10 (inc) to 18.10.8 (exc) |
| gitlab | gitlab_ee | From 12.10 (inc) to 18.10.8 (exc) |
| gitlab | gitlab_ce | From 18.11.0 (inc) to 18.11.5 (exc) |
| gitlab | gitlab_ee | From 18.11.0 (inc) to 18.11.5 (exc) |
| gitlab | gitlab_ce | From 19.0 (inc) to 19.0.2 (exc) |
| gitlab | gitlab_ee | From 19.0 (inc) to 19.0.2 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
