GitLab CE/EE EUVD-2026-57396

GitLab's advisory explicitly states exploitation is possible only 'under certain conditions,' though the specific triggering configuration or feature is not disclosed in the public advisory at time of analysis - the full details are visible in the referenced HackerOne report (#3638799) and GitLab work item #598561, both of which may be access-controlled. The CVSS vector (PR:N/UI:N) confirms no authentication or user interaction is required once conditions are met. SSVC's Automatable: no classification indicates these conditions are not trivially or programmatically detectable across arbitrary instances, limiting mass-scanning exploitation. Exploitation is further constrained to the three affected version streams (18.5-19.0.5, 19.1.0-19.1.3, 19.2.0-19.2.1); patched instances (19.0.6+, 19.1.4+, 19.2.2+) are not affected. GitLab.com (SaaS) was patched by GitLab and is not exploitable. Self-hosted deployments that have not applied the patch and happen to meet the undisclosed triggering conditions face the primary risk.

The CVSS 7.5 High score with AV:N/AC:L/PR:N/UI:N suggests trivially exploitable, unauthenticated network-based denial of service - but multiple corroborating signals significantly temper this assessment. SSVC classifies Automatable: no, which directly contradicts AC:L/PR:N and indicates that reliable, scripted exploitation is not straightforward. EPSS at 0.41% (34th percentile) is low, meaning fewer than one-third of CVEs are less likely to be exploited in the near term. The vulnerability is NOT in CISA KEV, confirming no confirmed active exploitation at time of analysis. A POC exists on HackerOne, which elevates near-term risk, but the 'under certain conditions' language in the official GitLab advisory means not all instances are exposed. CONFLICTING SIGNAL: The vendor-assigned CVSS AC:L is inconsistent with both the description's conditional language and SSVC's Automatable:no - defenders should treat AC as effectively higher until the specific triggering conditions are publicly confirmed. Net assessment: this is a meaningful DoS risk for GitLab self-hosted deployments that meet the undisclosed triggering conditions, but not a universal emergency for all GitLab instances.

An unauthenticated attacker identifies a GitLab instance running a vulnerable version (18.5 through pre-19.0.6, 19.1 before 19.1.4, or 19.2 before 19.2.2) that meets the undisclosed 'certain conditions.' Using the publicly available proof-of-concept from HackerOne report #3638799, the attacker submits a specially crafted HTTP request to a vulnerable endpoint, triggering unbounded resource consumption. With repeated or concurrent requests, the GitLab application process exhausts available memory or CPU, degrading or completely denying service to legitimate developers and CI/CD pipelines dependent on the instance.