What is the CVSS score of CVE-2026-1092?

CVE-2026-1092 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Gitlab are affected by CVE-2026-1092?

CVE-2026-1092 is a denial-of-service vulnerability affecting GitLab CE/EE that allows unauthenticated attackers to crash GitLab services through malformed JSON payloads, potentially disrupting…. A patch is available.

How to fix or mitigate CVE-2026-1092?

Within 24 hours: Identify all GitLab CE/EE instances and document current versions running 12.10-18.8.8, 18.9.0-18.9.4, or 18.10.0-18.10.2. Within 7 days: Apply vendor patch to upgrade affected instances to 18.8.9 or later, 18.9.5 or later, or 18.10.3 or later. Within 30 days: Validate patches across all environments and implement network-level access controls to restrict GitLab API endpoints to authorized users/systems only.

Gitlab CVE-2026-1092

EUVD-2026-20789 HIGH

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-04-08 cve@gitlab.com

GHSA-rp75-jg2c-frm4

Denial Of Service Gitlab

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:00 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

18.9.5,18.8.9,18.10.3

EUVD ID Assigned

Apr 08, 2026 - 23:24 euvd

EUVD-2026-20789

Analysis Generated

Apr 08, 2026 - 23:24 vuln.today

CVE Published

Apr 08, 2026 - 23:16 nvd

HIGH 7.5

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service due to improper input validation of JSON payloads.

AnalysisAI

Denial of service in GitLab CE/EE versions 12.10 through 18.8.8, 18.9 through 18.9.4, and 18.10 through 18.10.2 allows unauthenticated remote attackers to crash GitLab services via malformed JSON payloads. Improper input validation (CWE-1284) enables resource exhaustion attacks without authentication. CVSS 7.5 (High) reflects network-accessible attack with low complexity requiring no user interaction. No public exploit identified at time of analysis. EPSS data unavailable; not listed in CISA KEV.

Technical ContextAI

Root cause stems from insufficient validation of JSON input structure prior to processing, enabling crafted payloads to trigger resource exhaustion or parser failures. CWE-1284 indicates improper input validation mechanisms allowed malicious data through sanitization boundaries. Network vector with no privilege requirements creates broad attack surface across GitLab installations accepting external API requests.

RemediationAI

Vendor-released patch: GitLab 18.10.3, 18.9.5, or 18.8.9. Organizations should immediately upgrade to the applicable patched version for their release track. GitLab follows a three-version patch cadence for security issues. Official security advisory available at https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/ with complete upgrade procedures. For air-gapped or legacy environments unable to upgrade immediately, implement network-level rate limiting and payload size restrictions on GitLab API endpoints to mitigate unauthenticated JSON submission abuse. Review HackerOne report 3487030 and GitLab work item 586479 for technical implementation details of the fix.