CVE-2026-77801: 
GitLab 취약성 분석 및 완화

CVE-2026-77801 is a denial-of-service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) caused by missing object count limits in background job processing. It affects all versions from 12.8 before 19.1.7, versions 19.2 before 19.2.5, and versions 19.3 before 19.3.1. The vulnerability was published on August 26, 2026, and GitLab has released patches addressing the issue. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, GitLab Patch Release).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): GitLab fails to impose object count limits during certain background job processing operations, allowing an authenticated user to trigger excessive resource allocation. An attacker with low-privilege network access can exploit this by submitting requests that cause unbounded object creation or queuing in the background job system, ultimately exhausting processing capacity. No specific technical write-up or proof-of-concept code has been publicly released (GitHub Advisory, GitLab Patch Release).

Successful exploitation allows an authenticated user to disrupt background job processing on the affected GitLab instance, resulting in a high availability impact. Legitimate background operations — such as CI/CD pipeline processing, repository maintenance, and notification delivery — may be delayed or fail entirely. There is no confidentiality or integrity impact; the vulnerability is limited to availability of background job services (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of publication (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable. The EPSS score is approximately 0.34%, indicating a low probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE.

GitLab has released patched versions 19.1.7, 19.2.5, and 19.3.1 to address this vulnerability; upgrading to one of these versions is the recommended remediation (GitLab Patch Release). As interim mitigations, administrators can limit background job queue depth, implement rate limiting on authenticated users who can trigger bulk operations, and monitor background job processing for anomalies. Organizations running versions older than 12.8 should upgrade to a supported release.