What is the CVSS score of CVE-2026-7250?

CVE-2026-7250 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of GitLab CE/EE are affected by CVE-2026-7250?

GitLab Community and Enterprise editions spanning versions 12.10 through 19.0.1 are vulnerable to unauthenticated denial-of-service attacks via publicly documented exploits, threatening code…. A patch is available.

Is there a public PoC exploit available for CVE-2026-7250?

Yes, a public proof-of-concept exploit is available for CVE-2026-7250. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7250?

Within 24 hours: Identify all internet-exposed GitLab instances and document their versions; implement rate limiting on API endpoints and deploy Web Application Firewall rules to block malformed requests. Within 7 days: Obtain patches from GitLab vendor and schedule maintenance windows for upgrades to versions 18.11.5, 19.0.2, or later. Within 30 days: Complete upgrades of all vulnerable instances; for versions 12.10-18.10.8 without available patches, plan and execute migration to a patched release line.

GitLab CE/EE CVE-2026-7250

EUVD-2026-36227 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-06-11 GitLab

GHSA-cx4g-hr74-m89m

Gitlab Denial Of Service

7.5

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

API is network-reachable with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only via worker exhaustion (C:N/I:N/A:H), scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 11, 2026 - 13:01 EUVD

Analysis Generated

Jun 11, 2026 - 11:52 vuln.today

CVE Published

Jun 11, 2026 - 10:20 cve.org

HIGH 7.5

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper input validation in the API request parsing middleware.

Articles & Coverage 2

News 5 New GitLab Vulnerabilities - 5 High Severity, 4 With POC Jun 12, 2026 News 4 New GitLab Vulnerabilities - 4 High Severity, All With POC Jun 11, 2026

AnalysisAI

Denial of service in GitLab CE/EE versions 12.10 through 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 allows unauthenticated remote attackers to crash or degrade the API request parsing middleware via malformed input. Publicly available exploit code exists (HackerOne report 3671995), and the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/A:H) reflects trivially-reachable, no-auth exploitation against any internet-exposed GitLab instance. No CISA KEV listing at time of analysis.

Technical ContextAI

GitLab is a self-hosted and SaaS DevOps platform built on Ruby on Rails. The flaw lives in the API request parsing middleware - the Rack/Grape layer that deserializes incoming HTTP API requests before they reach controller logic. CWE-770 (Allocation of Resources Without Limits or Throttling) indicates the middleware accepts attacker-controlled input that triggers unbounded resource consumption (memory, CPU, or worker threads) because size/complexity limits are not enforced prior to parsing. Affected CPE is cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* covering both Community and Enterprise editions across the listed branches.

RemediationAI

Vendor-released patches: upgrade to GitLab 18.10.8, 18.11.5, or 19.0.2 (or later) as described in the June 10, 2026 patch release notes at https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-released/. Self-managed operators on long-unsupported versions in the 12.10-17.x range should plan an upgrade path to a current supported branch rather than backporting. As compensating controls until patching is possible, restrict API exposure by placing GitLab behind an authenticating reverse proxy or VPN (trade-off: breaks public API integrations and CI runners reaching from the internet), enable request-size limits and aggressive rate-limiting on /api/* at the upstream proxy (trade-off: may reject legitimate large GraphQL queries or repo uploads), and monitor Puma/Workhorse worker memory and crash rates for anomalous spikes. GitLab.com SaaS tenants require no action.