GitLab CE/EE: improper input validation lets an unauthenticated user cause a denial of service

Impact

GitLab fixed a condition under which an unauthenticated user could cause a denial of service through improper input validation. GitLab's advisory does not name the affected endpoint or describe the mechanism, so the concrete trigger is not public at this time. What is actionable for a fleet operator is the exposure: a self-hosted GitLab is usually the CI/CD and container-image path for the whole cluster, and taking it offline stalls builds, image promotion and GitOps reconciliation even though no GPU node is directly touched. Affected versions are 18.5 up to 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2.

Who can reach it

Unauthenticated network access to the GitLab instance. The advisory says exploitation is possible only "under certain conditions" without stating which; assume any internet- or tenant-reachable GitLab is in scope.

What to do

Upgrade to GitLab 19.0.6, 19.1.4, or 19.2.2 per the patch release and restart the GitLab services - a standard application upgrade window, no node maintenance involved. If the instance is internet-facing, prioritise it; otherwise restricting it to the internal network reduces exposure while you schedule the upgrade.

References

Related entries

• Splunk Enterprise Edge Processor sidecar: Prometheus metrics endpoint served without authenticationCVE-2026-76262 · Splunk Enterprise Edge Processor SPL2 Preview sidecar (Prometheus metrics endpoint)High
• Dell OpenManage Server Administrator (network-facing management service): OMSA is the in-band hardware management agentCVE-2026-81438 · Dell OpenManage Server Administrator (network-facing management service)High
• Linux kernel nfsd: uncapped POSIX ACL entry count drives an O(n^2) sort in the NFS serverCVE-2026-89695 · Linux kernel nfsd (NFSv4 POSIX ACL decoder, sort_pacl_range)High
• Linux kernel nfsd: crafted inter-server COPY compound reaches ops with a NULL filehandle and panics nfsdCVE-2026-89696 · Linux kernel nfsd (inter-server COPY, NFSD4_FH_FOREIGN compound dispatch)High
• Linux kernel nfsd: unbounded symlink target length lets a client force multi-MiB kmallocs per COMPOUND opCVE-2026-89699 · Linux kernel nfsd (NFSv4 CREATE symlink decoder, cr_datalen)High
• Linux kernel nfsd: async COPY samples the writeback error cursor late and reports failed copies as durableCVE-2026-89704 · Linux kernel nfsd (async server-side COPY, writeback error cursor in _nfsd_copy_file_range)High