EUVD-2026-80122
GHSA-8c2h-q92r-2j66
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated GraphQL endpoint reachable over the network with a ready-made query technique, so PR:N/AV:N/AC:L; only availability is impacted.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
4DescriptionCVE.org
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.
AnalysisAI
Unauthenticated denial of service in GitLab CE/EE (all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2) allows a remote attacker with no credentials to exhaust server resources through the GraphQL API by submitting queries whose true cost the complexity calculation under-counts. The flaw is an improper resource-allocation limit (CWE-770), scored CVSS 7.5 with the entire impact on availability (A:H) and none on confidentiality or integrity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The prerequisite is a GitLab CE/EE instance running an affected version with its GraphQL API endpoint reachable by the attacker (normally /api/graphql, enabled by default and commonly exposed wherever the web UI is exposed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here agree rather than conflict: CVSS 3.1 is 7.5 with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning a remote, unauthenticated, no-interaction attack with low complexity that degrades availability only - a textbook availability-flood profile rather than a data-breach profile, which is why the score stops at High instead of Critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | GitLab has released fixes in 19.1.8, 19.2.6, and 19.3.2, so the primary action is to upgrade to the appropriate patched release for your maintenance line - vendor-released patch: 19.3.2 (also 19.2.6 and 19.1.8) - following the instructions at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which GitLab CE/EE instances fall in the affected ranges (18.4.6 up to but not including 19.1.8; 19.2 up to but not including 19.2.6; 19.3 up to but not including 19.3.2), prioritize internet-facing and partner-exposed instances, and apply rate limiting and request-size caps at the reverse proxy or WAF in front of the GraphQL endpoint while tightening any available GitLab administrator-configured GraphQL complexity, depth, and pagination limits to reduce the under-counted query cost gap; simultaneously enable alerting on CPU, memory, worker saturation, and GraphQL request latency so resource-exhaustion attempts are detected quickly. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insuffici
JWT authentication bypass in @neo4j/graphql allows unauthenticated remote clients to forge arbitrary JWT claims over Gra
Authentication bypass in @neo4j/graphql exposes admin-restricted custom-resolver fields to any authenticated user holdin
silverstripe-graphql is a package which serves Silverstripe data in GraphQL representations. Rated high severity (CVSS 7
`silverstripe/graphql` serves Silverstripe data as GraphQL representations. Rated high severity (CVSS 7.5), this vulnera
GraphiQL is the reference implementation of this monorepo, GraphQL IDE, an official project under the GraphQL Foundation
GraphQL Playground is a GraphQL IDE for development of graphQL focused applications. Rated medium severity (CVSS 4.7), t
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today