GitLab EE: unauthenticated crafted file upload can deny service to the instance

Impact

An unauthenticated user can upload a specially crafted file that GitLab EE does not validate properly, causing a denial of service. On a self-hosted GitLab that drives CI/CD for training and serving pipelines, losing the instance stalls pipeline runs, runner job dispatch and container registry pushes until it recovers. The advisory does not describe the mechanism beyond improper validation of the uploaded file.

Who can reach it

Anyone who can reach the GitLab EE web interface over the network. No authentication required.

What to do

Upgrade GitLab EE to 18.9.7, 18.10.6 or 18.11.3 or later (all versions from 11.9 are affected). Upgrading restarts the GitLab services, so expect a short outage of the web UI, API and CI job dispatch.

References

Related entries

• IBM Storage Scale GUI (hardcoded inter-node token): A hardcoded token in the Storage Scale GUI source, usedCVE-2026-13460 · IBM Storage Scale GUI (hardcoded inter-node token)High
• Performance Co-Pilot: signed integer overflow in __pmGetPDU permanently blinds the collector daemonCVE-2026-16529 · Performance Co-Pilot pmcd/PMAPI (__pmGetPDU PDU length handling)High
• GitLab CE/EE: unauthenticated crafted requests can deny service to the instanceCVE-2026-1659 · GitLab CE/EE (request input validation)High
• Apache Airflow: session cookie is set at path=/ regardless of base_url, enabling cross-app takeoverCVE-2026-28779 · Apache Airflow (session cookie `_token` path scope)High
• Apache Airflow: SQL error stack traces returned by the API despite expose_stack_traces=falseCVE-2026-30912 · Apache Airflow API (SQL error handling)High
• Apache Airflow: task JWT tokens written to logs let UI users act as Dag authorsCVE-2026-31987 · Apache Airflow (task JWT tokens in logs)High