What is the CVSS score of EUVD-2026-32622?

EUVD-2026-32622 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-32622?

Yes, a patch is available for EUVD-2026-32622. Update the affected software to the latest version immediately.

GitLab CE/EE EUVD-2026-32622

| CVE-2026-1402 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-27 cve@gitlab.com

GHSA-wgq9-qp63-g8j3

Gitlab Denial Of Service

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:04 vuln.today

Patch available

May 27, 2026 - 20:04 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user to cause denial of service due to insufficient validation.

AnalysisAI

Denial of service in GitLab CE/EE affects all versions from 17.1 through those prior to 18.10.7, 18.11.4, and 19.0.1, allowing a low-privileged authenticated user to crash or degrade service availability through insufficient input validation. The root cause is CWE-770 (resource allocation without limits or throttling), meaning a specially crafted request can exhaust server-side resources under certain conditions. Publicly available exploit code exists per SSVC assessment, though CISA has not added this to the Known Exploited Vulnerabilities catalog and automated mass exploitation is considered unlikely.

Technical ContextAI

GitLab CE/EE is a self-hosted and SaaS DevOps platform. CWE-770 (Allocation of Resources Without Limits or Throttling) describes a root cause where the application fails to impose appropriate bounds on a user-controlled operation, allowing an attacker to consume excessive CPU, memory, or I/O resources. In GitLab's case, the vulnerability manifests when an authenticated user submits input that bypasses or exhausts validation logic, triggering unbounded resource consumption. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms the flaw is reachable over the network, requires low complexity to exploit, demands only a standard authenticated account, and results in complete availability impact with no confidentiality or integrity loss. The affected version range spans GitLab 17.1 through just before 18.10.7, 18.11.x before 18.11.4, and 19.0.x before 19.0.1.

RemediationAI

Upgrade to one of the patched releases confirmed by the vendor advisory published 2026-05-27: GitLab 18.10.7, 18.11.4, or 19.0.1 (https://about.gitlab.com/releases/2026/05/27/patch-release-gitlab-19-0-1-released/). Organizations unable to patch immediately should consider rate-limiting authenticated API and web requests at the reverse proxy or WAF layer - this introduces latency trade-offs for legitimate heavy users but limits the blast radius of resource-exhaustion attempts. Restricting project membership and ensuring guest or reporter roles are granted only to trusted users reduces the attack surface, since the vulnerability requires at minimum a low-privilege authenticated account. Monitoring for anomalous CPU or memory spikes correlated with specific user accounts can help detect exploitation attempts before a full outage occurs. Note that workarounds do not eliminate the vulnerability and patching remains the only complete fix.