CVE-2026-1403

Received Received - Intake

Denial of Service in GitLab CE/EE via CSV Import

Publication date: 2026-10-07

Last updated on: 2026-10-07

Assigner: GitLab Inc.

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file structure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-07

Generated

2026-10-08

AI Q&A

2026-10-08

EPSS Evaluated

N/A

NVD

CVE-2026-1403

Affected Vendors & Products

Vendor	Product	Version / Range
GitLab	GitLab	11.7
GitLab	GitLab	18.9
GitLab	GitLab	18.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in GitLab CE/EE versions 11.7 to 18.8.8, 18.9.0 to 18.9.4, and 18.10.0 to 18.10.2 allows an authenticated user to disrupt Sidekiq workers by importing maliciously crafted CSV files. The issue stems from improper validation of CSV file structure during import.

Detection Guidance

This vulnerability involves improper CSV file validation in GitLab leading to Sidekiq worker DoS. Detection requires checking GitLab versions and monitoring Sidekiq worker performance. Verify installed GitLab versions against patched releases (18.8.9, 18.9.5, 18.10.3). Monitor Sidekiq queues for unusual delays or crashes during CSV import operations.

Impact Analysis

An attacker could exploit this to cause a denial of service, making background jobs like email notifications or repository updates unavailable. This could slow down or halt normal GitLab operations for all users.

Compliance Impact

This vulnerability causes denial of service to Sidekiq workers due to improper CSV file validation, which could disrupt system operations and availability. This may impact compliance with standards requiring data availability and integrity, such as GDPR (availability principle) and HIPAA (accessibility and integrity of protected health information).

Mitigation Strategies

Upgrade GitLab to a patched version (18.8.9, 18.9.5, or 18.10.3 or later) to address the CSV import issue causing Sidekiq denial of service.

Hi! I’m here to help you understand CVE-2026-1403. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70