What is the CVSS score of CVE-2026-1662?

CVE-2026-1662 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Jira are affected by CVE-2026-1662?

GitLab instances running version 18.7.5 or earlier are vulnerable to resource exhaustion attacks that could render the platform unavailable to users.

How to fix or mitigate CVE-2026-1662?

Within 24 hours: Inventory all GitLab instances and document current versions. Within 7 days: Implement network-level rate limiting on GitLab API endpoints and monitor resource consumption metrics for anomalies. Within 30 days: Establish a patch release monitoring protocol with the vendor and develop a staged upgrade plan for when patches become available.

Jira CVE-2026-1662

HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-02-25 cve@gitlab.com

Gitlab Jira Denial Of Service

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 25, 2026 - 21:16 nvd

HIGH 7.5

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint.

AnalysisAI

Gitlab versions up to 18.7.5 is affected by allocation of resources without limits or throttling (CVSS 7.5).

Technical ContextAI

This vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) affects Gitlab. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to the Jira events endpoint.