What is the CVSS score of CVE-2026-3988?

CVE-2026-3988 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Gitlab are affected by CVE-2026-3988?

GitLab instances are vulnerable to remote denial-of-service attacks that can render the platform completely unavailable without requiring authentication.. A patch is available.

Is there a public PoC exploit available for CVE-2026-3988?

Yes, a public proof-of-concept exploit is available for CVE-2026-3988. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-3988?

Within 24 hours: Inventory all GitLab CE/EE instances and confirm versions; implement network-level rate limiting on GraphQL endpoints (/api/graphql) and restrict API access to known trusted networks if possible. Within 7 days: Deploy WAF rules to detect and block malicious GraphQL queries with excessive complexity; monitor GitLab logs for suspicious GraphQL requests; establish incident response procedures for potential DoS events. Within 30 days: Upgrade to patched versions immediately upon availability (monitor GitLab security announcements daily); evaluate temporary migration of critical CI/CD workloads to alternative platforms if business continuity is severely impacted.

Gitlab CVE-2026-3988

EUVD-2026-15937 HIGH

Inefficient Algorithmic Complexity (CWE-407)

2026-03-25 GitLab

GHSA-2jhc-hf67-8vgx

Gitlab Denial Of Service

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 26, 2026 - 17:42 vuln.today

Public exploit code

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15937

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:33 nvd

HIGH 7.5

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance unresponsive due to improper input validation in GraphQL request processing.

AnalysisAI

GitLab CE/EE contains a denial of service vulnerability in GraphQL request processing due to improper input validation (CWE-407). All versions from 18.5 through 18.8.6, 18.9 through 18.9.2, and 18.10 before 18.10.1 are affected. An unauthenticated attacker can remotely exploit this with low complexity to render GitLab instances unresponsive, and a public proof-of-concept exploit is available via HackerOne report 3597342.

Technical ContextAI

This vulnerability affects GitLab's GraphQL API endpoint, specifically in how it validates and processes incoming requests. The root cause is classified as CWE-407 (Inefficient Algorithmic Complexity), indicating the flaw allows attackers to trigger resource-intensive operations through specially crafted GraphQL queries. GitLab's GraphQL API is used for programmatic access to GitLab resources and is a core component of both Community Edition (CE) and Enterprise Edition (EE). The affected product is identified via CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*, confirming this impacts the entire GitLab product line across multiple recent major versions in the 18.x series.

RemediationAI

Immediately upgrade GitLab to one of the patched versions: 18.8.7 or later for the 18.8 series, 18.9.3 or later for the 18.9 series, or 18.10.1 or later for the 18.10 series, as documented in the official security advisory at https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/. Until patching is possible, implement rate limiting and request size restrictions on the GraphQL API endpoint at the reverse proxy or web application firewall level to mitigate potential denial of service attacks. Additionally, restrict network access to GitLab instances to trusted IP ranges and implement monitoring for unusual GraphQL query patterns or resource consumption spikes.