EUVD-2026-36222
GHSA-8322-7g6r-mw9p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Network-accessible, low-complexity DoS requires only a low-privilege authenticated account; no confidentiality or integrity impact confirmed from available data.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that could have allowed an authenticated user to cause denial of service on the CI/CD Catalog page due to improper sanitization.
AnalysisAI
Denial of service on the GitLab CI/CD Catalog page is achievable by any authenticated user across a broad version range (17.0 through pre-patch releases of 18.10, 18.11, and 19.0) due to improper sanitization of user-supplied content. The low-privilege, network-accessible attack vector means any GitLab account holder can trigger the condition without elevated permissions or complex setup. No public exploit code or CISA KEV listing has been identified at time of analysis, and the limited availability impact (A:L) constrains real-world severity, though the wide version exposure across three concurrent release branches broadens organizational risk.
Technical ContextAI
GitLab CE and EE are self-hosted and SaaS DevSecOps platforms; the CI/CD Catalog is a feature introduced in the 17.x series that allows organizations to share reusable pipeline components. The vulnerability is classified as CWE-1021 (Improper Restriction of Rendered UI Layers or Frames), which canonically covers UI-redressing and clickjacking patterns. However, the vendor description explicitly cites 'improper sanitization' and the intelligence tags include both 'XSS' and 'Denial Of Service' - suggesting that unsanitized user-supplied input (such as catalog component names, descriptions, or metadata) is being rendered without adequate filtering, causing excessive DOM processing, render loops, or similar client-side resource exhaustion when the catalog page loads. The CPE string cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* applies broadly to all GitLab editions. The CWE assignment may reflect that the sanitization gap allows injected content to interfere with rendered UI layers rather than traditional script execution - a CWE-1021/XSS boundary case that warrants vendor clarification.
RemediationAI
The primary remediation is to upgrade to a patched GitLab release: 18.10.8, 18.11.5, or 19.0.2, depending on the currently deployed branch. The vendor patch advisory is at https://about.gitlab.com/releases/2026/06/10/patch-release-gitlab-19-0-2-released/. For organizations unable to patch immediately, a targeted compensating control is to restrict access to the CI/CD Catalog feature via GitLab's application-level settings (Admin Area > Settings > CI/CD), which would prevent unprivileged users from submitting catalog content - note this disables catalog sharing functionality for all users. Alternatively, network-layer access controls that limit which authenticated accounts can reach the catalog namespace endpoints (/catalog path) reduce exposure to trusted users only. Neither workaround eliminates the underlying sanitization flaw; patching is the only definitive fix. GitLab SaaS customers require no action.
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. Rated critical severity (CVSS 9.8), this vulnerability is
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6
Share
External POC / Exploit Code
Leaving vuln.today