What is the CVSS score of EUVD-2026-30222?

EUVD-2026-30222 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of GitLab CE/EE are affected by EUVD-2026-30222?

A denial-of-service vulnerability in GitLab Community and Enterprise editions allows any network-accessible attacker to crash instances and halt development pipelines and CI/CD operations.. A patch is available.

How to fix or mitigate EUVD-2026-30222?

24 hours: Identify and document all GitLab instances, their versions, and operational criticality. 7 days: Apply vendor patches by upgrading to version 18.10.6, 18.11.3, or later stable releases. 30 days: Verify patching completion across all instances and establish version management controls.

GitLab CE/EE EUVD-2026-30222

| CVE-2026-1659 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-14 cve@gitlab.com

GHSA-vgrr-9p4p-xw4w

Denial Of Service Gitlab

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:42 vuln.today

Patch available

May 14, 2026 - 07:01 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation.

AnalysisAI

Denial of service in GitLab CE/EE allows unauthenticated remote attackers to disrupt service availability by sending specially crafted requests that exploit insufficient input validation. Affected versions span 9.0 through 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 across both Community and Enterprise editions, with no public exploit identified at time of analysis and a low EPSS score (0.04%) indicating limited near-term exploitation likelihood despite the network-reachable attack surface.

Technical ContextAI

GitLab is a self-hosted and SaaS DevOps platform built on Ruby on Rails that exposes numerous HTTP endpoints for repository, CI/CD, and API operations. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), meaning a request handler accepts attacker-controlled input that triggers unbounded resource consumption - typically CPU, memory, or worker threads - without enforcing size, rate, or complexity limits. The CPE strings confirm both Community Edition and Enterprise Edition product trees are within scope, indicating the vulnerable code path is in shared core functionality rather than an edition-specific feature.

RemediationAI

Vendor-released patches are available - upgrade to GitLab 18.11.3, 18.10.6, or 18.9.7 depending on the deployment branch, per the GitLab patch release announcement at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/ and the internal tracking issue at https://gitlab.com/gitlab-org/gitlab/-/work_items/588201. For instances that cannot be patched immediately, restrict network exposure of the GitLab web interface and API to trusted networks via a WAF or reverse proxy with request size and rate limits, and consider blocking anonymous access to public endpoints where feasible; note that rate-limiting at the proxy layer may degrade legitimate CI/CD webhook traffic and Git operations under heavy load, so tune thresholds against baseline traffic before enforcing.