PT-2026-7515 · Gitlab · Gitlab Ce/Ee

A92847865 · Published 2026-02-11 · Updated 2026-02-12 · CVE-2026-1387

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GitLab EE versions 15.6 through 18.6.6 GitLab EE versions 18.7 through 18.7.4 GitLab EE versions 18.8 through 18.8.4

Description An authenticated user could cause a Denial of Service by uploading a malicious file and repeatedly querying it through GraphQL. The issue affects GitLab EE.

Recommendations Update GitLab EE to version 18.6.6 or later. Update GitLab EE to version 18.7.4 or later. Update GitLab EE to version 18.8.4 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-1387

Affected Products

Gitlab Ce/Ee

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1387.json · Exploit
• 🔥 https://hackerone.com/reports/3515994 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1387 · Security Note
• https://ubuntu.com/security/CVE-2026-1387 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1387 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1387 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-1387 · Security Note
• https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released · Vendor Advisory
• https://twitter.com/CVEnew/status/2021554580757135548 · Twitter Post
• https://t.me/cveNotify/151894 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/587546 · Note
• https://twitter.com/VulmonFeeds/status/2021577767402307683 · Twitter Post