GitLab CE/EE EUVD-2026-94613

Requires an authenticated GitLab CE/EE account with permission to use a CSV import feature (PR:L); the flaw is triggered by uploading a CSV file with an improperly validated structure, which overloads Sidekiq background workers. Limiting factors: the attacker must already hold a valid account with import rights, so anonymous/pre-authentication exploitation is not possible; impact is restricted to availability of background job processing (no data exposure or modification). Affected deployments are GitLab versions from 11.7 up to the fixed releases 18.8.9, 18.9.5, and 18.10.3. Risk is highest on multi-tenant or internet-facing instances that allow low-trust users to self-register or import data.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 6.5 (Medium), and all impact is confined to availability - there is no confidentiality or integrity loss, only denial of service to Sidekiq background workers. Signals are largely consistent and point AWAY from urgency: CISA SSVC lists Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', which aligns with the authenticated-user (PR:L) requirement and DoS-only outcome. The one elevating signal is a publicly available HackerOne report (POC exists), but POC availability is distinct from active exploitation - there is NO CISA KEV listing and SSVC exploitation is 'none', so there is no evidence of in-the-wild abuse. EPSS was not provided in the input, so exploitation probability could not be factored in; this is a data gap. The requirement for an authenticated account that can perform CSV imports meaningfully limits the attacker population to existing authorized users, making this more of an abuse-of-privilege DoS than a remote pre-auth threat. Net: patch on a normal priority cycle, prioritizing internet-facing multi-tenant GitLab instances where low-privilege accounts are abundant.

A low-privileged but authenticated GitLab user uploads a maliciously structured CSV file through an import feature (e.g., issue import); because the CSV structure is improperly validated, parsing consumes excessive Sidekiq worker resources and degrades or halts background job processing for the instance. A public proof-of-concept exists in the referenced HackerOne report (#3328937), lowering the effort to reproduce. Because the attack is network-reachable (AV:N) with low complexity (AC:L) and no user interaction, any account with import permissions on a shared instance can trigger it.