CVE-2026-1092

HIGH

Improper Validation of Specified Quantity in Input in GitLab

Title source: cna

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service due to improper input validation of JSON payloads.

References (3)

[Exploit] https://hackerone.com/reports/3487030

https://gitlab.com/gitlab-org/gitlab/-/work_items/586479

https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/

Scores

CVSS v3 7.5

EPSS 0.0004

EPSS Percentile 11.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-1284

Status published

Products (4)

GitLab/GitLab 12.10 - 18.8.9

gitlab/gitlab 12.10.0 - 18.8.9 (2 CPE variants)

GitLab/GitLab 18.10 - 18.10.3

GitLab/GitLab 18.9 - 18.9.5

Published Apr 08, 2026

Tracked Since Apr 09, 2026