What is the CVSS score of CVE-2026-0958?

CVE-2026-0958 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Gitlab are affected by CVE-2026-0958?

GitLab instances running versions 18.4 through 18.8.x are vulnerable to unauthenticated denial-of-service attacks that could exhaust server resources and disrupt service availability.

How to fix or mitigate CVE-2026-0958?

Within 24 hours: Inventory all GitLab instances and their versions; enable rate limiting and request size restrictions at the WAF/load balancer level targeting JSON endpoints. Within 7 days: Implement network-based request filtering to block suspicious JSON payloads; consider isolating affected GitLab instances or enabling restrictive access controls if business-critical. Within 30 days: Establish a patch deployment plan; monitor vendor advisories for available fixes and deploy immediately upon release.

Gitlab CVE-2026-0958

HIGH

Interpretation Conflict (CWE-436)

2026-02-11 cve@gitlab.com

Gitlab Denial Of Service

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 11, 2026 - 12:16 nvd

HIGH 7.5

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through memory or CPU exhaustion by bypassing JSON validation middleware limits.

AnalysisAI

GitLab CE/EE versions 18.4 through 18.8 are vulnerable to unauthenticated denial of service attacks where an attacker can exhaust server resources by circumventing JSON validation limits. An unauthenticated remote attacker can trigger excessive memory or CPU consumption without authentication or user interaction, potentially rendering the service unavailable. Currently no patch is available for this vulnerability.

Technical ContextAI

Classified as CWE-436 (Interpretation Conflict). Affects Gitlab. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through memory or CPU exhaustion by bypassing JSON validation middleware limits.