CVE-2026-1168
Received
Received - Intake
Denial of Service in GitLab CE/EE via GraphQL Complexity
Vulnerability report for CVE-2026-1168, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-16
Last updated on: 2026-09-16
Assigner: GitLab Inc.
Description
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab_ce | From 18.4.6 (inc) to 19.1.8 (exc) |
| gitlab | gitlab_ee | From 18.4.6 (inc) to 19.1.8 (exc) |
| gitlab | gitlab_ce | to 19.2.6 (exc) |
| gitlab | gitlab_ee | to 19.2.6 (exc) |
| gitlab | gitlab_ce | to 19.3.2 (exc) |
| gitlab | gitlab_ee | to 19.3.2 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
