What is the CVSS score of CVE-2026-15975?

CVE-2026-15975 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of GitLab are affected by CVE-2026-15975?

GitLab CE/EE versions 11.8 through 19.2.0 contain an unauthenticated denial-of-service vulnerability affecting merge request processing that could disrupt service availability.. A patch is available.

How to fix or mitigate CVE-2026-15975?

Within 24 hours: Inventory all GitLab deployments and identify instances running affected versions (11.8-19.0.4, 19.1.0-19.1.2, 19.2.0). Within 7 days: Develop an upgrade plan and test GitLab 19.0.5, 19.1.3, 19.2.1, or later in non-production to verify compatibility and CI/CD pipeline functionality. Within 30 days: Execute the upgrade across all affected instances in priority order (production systems first), with post-upgrade testing of merge request workflows and connected integrations.

GitLab CVE-2026-15975

EUVD-2026-50476 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-29 GitLab

GHSA-x55f-grmq-xwwm

Denial Of Service Gitlab

7.5

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

Network-reachable, unauthenticated availability-only DoS, but vendor's 'under certain conditions' qualifier justifies AC:H rather than AC:L; no confidentiality or integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 29, 2026 - 20:02 EUVD

Analysis Generated

Jul 29, 2026 - 19:56 vuln.today

CVE Published

Jul 29, 2026 - 18:59 cve.org

HIGH 7.5

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing merge request discussions.

Articles & Coverage 2

News 3 New GitLab Vulnerabilities - 3 High Severity, 2 With POC Jul 30, 2026 News 3 New GitLab Vulnerabilities - 3 High Severity, 2 With POC Jul 29, 2026

AnalysisAI

Denial of service in GitLab CE/EE (all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1) allows an unauthenticated attacker to exhaust server resources through insufficient throttling when the application processes merge request discussions. Vendor-reported by GitLab with no public exploit identified at time of analysis; the availability-only impact (CVSS 7.5, A:H) reflects service disruption rather than data compromise. Exploitation is conditional ('under certain conditions'), which tempers the otherwise network-reachable, no-auth attack surface.

Technical ContextAI

GitLab is a self-hosted and SaaS DevOps platform (cpe:2.3:a:gitlab:gitlab) providing Git repository hosting, CI/CD, and code review via merge requests. The flaw is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): the code path handling merge request discussion processing does not adequately cap or rate-limit the work or memory it performs per request, so a crafted or repeated interaction can drive resource consumption beyond safe bounds. Because merge request discussion endpoints are part of the collaborative review workflow, they can be reachable without authentication in certain configurations, expanding the exposed surface.

RemediationAI

Vendor-released patch: upgrade to GitLab 19.0.5, 19.1.3, or 19.2.1 (or later) depending on your current branch, per the GitLab patch release advisory (https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released/). Self-managed operators on the 19.0.x line should move to 19.0.5, 19.1.x to 19.1.3, and 19.2.x to 19.2.1; older 11.8-18.x installations should upgrade to a fixed release following GitLab's supported upgrade path. As a compensating control until patched, place the GitLab web/API front end behind a reverse proxy or WAF and apply rate limiting to merge request and discussion endpoints, and where feasible restrict anonymous/unauthenticated access to projects and merge requests (trade-off: this reduces exposure but breaks public/open-source project browsing and any unauthenticated integrations). Monitor for abnormal CPU/memory spikes tied to merge request activity as a detection measure.