CVE-2026-7250
Analyzed
Analyzed - Analysis Complete
Denial of Service in GitLab CE/EE via API Request Parsing
Vulnerability report for CVE-2026-7250, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-06-11
Last updated on: 2026-06-11
Assigner: GitLab Inc.
Description
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper input validation in the API request parsing middleware.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab | From 18.11.0 (inc) to 18.11.5 (exc) |
| gitlab | gitlab | From 19.0.0 (inc) to 19.0.2 (exc) |
| gitlab | gitlab | From 18.11.0 (inc) to 18.11.5 (exc) |
| gitlab | gitlab | From 19.0.0 (inc) to 19.0.2 (exc) |
| gitlab | gitlab | From 12.10.0 (inc) to 18.10.8 (exc) |
| gitlab | gitlab | From 12.10.0 (inc) to 18.10.8 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
