What is the CVSS score of CVE-2026-1184?

CVE-2026-1184 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-1184?

Yes, a patch is available for CVE-2026-1184. Update the affected software to the latest version immediately.

GitLab EE CVE-2026-1184

EUVD-2026-30219 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-05-14 cve@gitlab.com

GHSA-jfvp-pw77-78h3

Gitlab Deserialization Denial Of Service

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:25 vuln.today

Patch available

May 14, 2026 - 07:01 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by uploading a specially crafted file due to improper validation.

AnalysisAI

Denial-of-service in GitLab Enterprise Edition allows a crafted file upload to exhaust service availability through improper deserialization validation. The vulnerability spans an exceptionally wide range, affecting all GitLab EE instances from version 11.9 through the 18.11 line until patched releases. There is no public exploit identified at time of analysis and EPSS sits at 0.02% (4th percentile), indicating low observed exploitation pressure, though the breadth of the affected version range means unpatched installations represent a meaningful attack surface for availability disruption.

Technical ContextAI

The root cause is classified as CWE-502 (Deserialization of Untrusted Data), consistent with the 'Deserialization' tag in the intelligence data. GitLab's file upload handling fails to adequately validate or sanitize serialized content in submitted files, allowing a malformed payload to trigger error conditions or resource exhaustion during the deserialization phase. The affected product is exclusively the Enterprise Edition (EE) tier, as confirmed by CPE strings cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* across all three affected version ranges. The Community Edition does not appear in CPE data and is not implicated. GitLab EE's file upload features (attachments, artifacts, packages, etc.) interact with backend deserialization logic, and insufficient input validation at that boundary is the proximate technical cause.

RemediationAI

Vendor-released patches are available. Organizations should upgrade GitLab EE to one of the following fixed versions: 18.9.7, 18.10.6, or 18.11.3 depending on their current branch. The official patch release announcement with full details is at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. For environments that cannot immediately patch, a targeted compensating control is to restrict or disable file upload endpoints at the reverse proxy or WAF layer for untrusted or unauthenticated network sources - this limits exposure while upgrade is scheduled, at the cost of disrupting legitimate file upload workflows. If the CVSS PR:L vector is authoritative (authenticated exploitation only), ensuring all external-facing GitLab EE instances require authentication before accessing upload features is a meaningful interim mitigation. Organizations running versions as old as 11.9 should treat this as an urgent upgrade driver regardless, given the accumulation of vulnerabilities across such a wide version span.