CVE-2026-1403

EUVD-2026-94613
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that when importing CSV files could have allowed an authenticated user to cause denial of service to Sidekiq workers due to improper validation of CSV file structure.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitLabCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 23.8%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
gitlabgitlab
11.7 ≤
𝑥
< 18.8.9
CNA
gitlabgitlab
18.9 ≤
𝑥
< 18.9.5
CNA
gitlabgitlab
18.10 ≤
𝑥
< 18.10.3
CNA
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
gitlab
jammy
dne
noble
dne
questing
dne
xenial
ignored
Common Weakness Enumeration
References
https://gitlab.com/gitlab-org/gitlab/-/work_items/587573
https://hackerone.com/reports/3328937