What is the CVSS score of CVE-2026-1660?

CVE-2026-1660 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-1660?

Yes, a public proof-of-concept exploit is available for CVE-2026-1660. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-1660?

Yes, a patch is available for CVE-2026-1660. Update the affected software to the latest version immediately.

GitLab CE/EE CVE-2026-1660

EUVD-2026-24959 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-04-22 GitLab

GHSA-xv99-vgw5-r3gg

Gitlab Denial Of Service

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

PoC Detected

Apr 23, 2026 - 20:45 vuln.today

Public exploit code

Patch released

Apr 23, 2026 - 20:45 nvd

Patch available

Analysis Generated

Apr 23, 2026 - 00:17 vuln.today

Patch available

Apr 22, 2026 - 17:33 EUVD

EUVD ID Assigned

Apr 22, 2026 - 16:31 euvd

EUVD-2026-24959

Analysis Generated

Apr 22, 2026 - 16:31 vuln.today

CVE Published

Apr 22, 2026 - 16:04 nvd

MEDIUM 6.5

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user to cause denial of service when importing issues due to improper input validation.

AnalysisAI

Denial of service in GitLab CE/EE versions 12.3 through 18.11.0 allows authenticated users to trigger excessive resource consumption during issue import operations due to improper input validation on user-supplied data. The vulnerability affects all minor versions from 12.3 onwards until patched versions 18.9.6, 18.10.4, and 18.11.1. Publicly available exploit code exists, and CISA SSVC assessment indicates the vulnerability is exploitable but not automatable at scale.

Technical ContextAI

The vulnerability stems from CWE-770 (allocation of resources without limits or throttling), a resource exhaustion flaw. GitLab's issue import functionality processes user-provided input without proper validation or rate limiting. An authenticated user can craft malicious import payloads that cause the import engine to allocate excessive memory, CPU, or I/O resources, rendering the service unavailable. The flaw affects GitLab Community Edition and Enterprise Edition across all deployment modes (self-hosted and SaaS) that have not applied the patched versions. CPE cpe:2.3:a:gitlab:gitlab indicates the vulnerability is inherent to the core GitLab application regardless of installation method.

RemediationAI

Upgrade to patched versions immediately: GitLab 18.9.6 or later, GitLab 18.10.4 or later, or GitLab 18.11.1 or later, depending on your current major/minor version branch. Organizations unable to patch immediately should restrict issue import functionality to trusted administrators only by implementing role-based access controls within GitLab project settings, disabling the import feature entirely for non-administrative users via group-level policies, or rate-limiting import API endpoints at the reverse proxy or load-balancer level to prevent single-user resource exhaustion attacks. Each workaround carries trade-offs: access restrictions reduce user autonomy and may impact legitimate workflows; disabling imports removes functionality entirely; rate-limiting may affect legitimate bulk imports. Vendor advisory and patch availability confirmed at https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/.