GitLab CE/EE: authenticated user can stall background job processing via missing object count limits

Impact

An authenticated user can, under conditions the advisory does not detail, submit work that lacks an object count limit and exhaust GitLab's background job processing. Background jobs are what run pipelines, mirror repositories, deliver webhooks and process artifacts, so the visible effect is that CI stops moving while the web UI still answers. On a fleet where GitLab pipelines gate model builds and deployment to GPU nodes, this is a build-and-deploy outage rather than a data exposure - confidentiality and integrity are unaffected per the vendor scoring. The record gives no detail on which object type is unbounded, so treat the trigger as unknown.

Who can reach it

Any authenticated GitLab user with network access to the instance; no elevated project or admin role is stated as required.

What to do

Upgrade to GitLab 19.3.1, 19.2.5 or 19.1.7 depending on branch; all versions from 12.8 are affected. Package upgrade plus a restart of the GitLab services, notably Sidekiq - no node drain or reboot. GitLab.com already runs the patched version.

References

Related entries

• Fortra BoKS Manager: oversized digest name in a KSL start message overflows a fixed 16-byte checksum fieldCVE-2026-79900 · Fortra BoKS Manager boks_ksllogsd (KSL start message digest name)Medium
• Schneider Electric Data Center Expert - SOAP service endpoints: XML external entity processing on DCE SOAP endpointsCVE-2026-8045 · Schneider Electric Data Center Expert - SOAP service endpointsMedium
• Dell OpenManage Server Administrator (authorization checks): A second, distinct flaw in the same OMSA versionsCVE-2026-81439 · Dell OpenManage Server Administrator (authorization checks)Medium
• Airflow Akeyless provider: path-shaped Variable key bypasses the team-scope guard on secret lookupCVE-2026-86465 · Apache Airflow Akeyless provider (secrets backend, team-scope guard)Medium
• Jenkins Bitbucket Push and Pull Request Plugin: webhook payload can redirect credentialed requestsCVE-2026-92139 · Jenkins Bitbucket Push and Pull Request Plugin (webhook-supplied URLs)Medium
• Airflow HashiCorp provider: path-shaped Variable key crosses team scope in the Vault secrets backendCVE-2026-97636 · Apache Airflow HashiCorp provider (Vault secrets backend, team-scoped variable lookup)Medium