CVE-2026-0958: 
GitLab vulnerability analysis and mitigation

CVE-2026-0958 is a Denial of Service vulnerability in GitLab CE/EE's JSON validation middleware that allows unauthenticated attackers to cause memory or CPU exhaustion by bypassing middleware size limits. It affects all GitLab CE/EE versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4. The vulnerability was disclosed and patched on February 10, 2026, and was reported via GitLab's HackerOne bug bounty program by researcher 'elbo7'. It carries a CVSS v3.1 base score of 7.5 (High) (GitLab Advisory, Red Hat CVE).

The root cause is classified as CWE-436 (Interpretation Conflict), arising from a flaw in how GitLab's JSON validation middleware enforces payload size or complexity limits — an attacker can craft requests that bypass these controls, causing the server to consume excessive memory or CPU during JSON parsing. The attack vector is network-accessible (AV:N), requires no authentication (PR:N), no user interaction (UI:N), and has low attack complexity (AC:L), making it trivially exploitable against any exposed GitLab instance. The vulnerability is specific to versions introduced in 18.4, suggesting the middleware behavior was introduced or changed in that release cycle (GitLab Advisory, Red Hat CVE).

Successful exploitation results in a denial of service condition affecting availability of the GitLab instance — confidentiality and integrity are not impacted. An unauthenticated attacker can repeatedly send crafted JSON payloads to exhaust server memory or CPU, rendering the GitLab service unavailable to all users relying on the affected instance. This impacts CI/CD pipelines, code repositories, and collaboration workflows for all users of self-managed GitLab deployments running affected versions (GitLab Advisory, Red Hat CVE).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing GitLab CE/EE instances running versions 18.4.x–18.6.5, 18.7.0–18.7.3, or 18.8.0–18.8.3 using tools like Shodan, Censys, or by probing the GitLab version endpoint (e.g., /api/v4/version or the login page footer).
2. Craft malicious JSON payload: Construct an oversized or deeply nested JSON payload designed to bypass the middleware's validation limits — for example, an extremely large JSON body or a deeply recursive JSON structure that triggers excessive parsing overhead.
3. Send repeated requests: Submit the crafted payload via unauthenticated HTTP POST requests to a GitLab API endpoint that accepts JSON input (e.g., /api/v4/ endpoints), without requiring any session token or credentials.
4. Exhaust server resources: Repeat the requests in rapid succession or in parallel to sustain memory or CPU exhaustion, causing the GitLab web service to become unresponsive or crash, resulting in a denial of service for all users (GitLab Advisory).

• Network: Unusual volume of HTTP POST requests to GitLab API endpoints (e.g., /api/v4/) from a single or small set of IP addresses; requests with abnormally large Content-Length headers or deeply nested JSON bodies.
• Logs: GitLab production logs (/var/log/gitlab/gitlab-rails/production.log) showing repeated 413, 422, or 500 errors associated with JSON parsing; Nginx/Puma access logs showing high request rates from specific source IPs targeting API endpoints.
• Process/System: Sustained high CPU or memory utilization on the GitLab application server (Puma workers); OOM (Out of Memory) killer events in system logs (/var/log/syslog or dmesg) related to GitLab processes.
• Availability: Sudden degradation or complete unavailability of the GitLab web interface and API coinciding with the above network patterns.

GitLab has released patched versions addressing this vulnerability: 18.6.6 (for 18.4–18.6 deployments), 18.7.4 (for 18.7 deployments), and 18.8.4 (for 18.8 deployments), all released on February 10, 2026. GitLab.com is already running the patched version; GitLab Dedicated customers do not need to take action. Self-managed GitLab administrators should upgrade to the appropriate patched version immediately. As a temporary network-level workaround, rate limiting or payload size restrictions can be enforced at the reverse proxy or WAF layer to reduce exposure until patching is complete (GitLab Advisory).

The patch release attracted coverage from multiple cybersecurity news outlets including CyberSecurityNews, GBHackers, and SecurityOnline, which highlighted the broader batch of fixes addressing DoS and XSS vulnerabilities in GitLab. Community discussion noted the significance of the unauthenticated attack vector and low complexity, with some outlets urging immediate upgrades for self-managed deployments (CyberSecurityNews, GBHackers). NotebookCheck and The Daily Tech Feed also covered the release, emphasizing the risk to repositories and services (NotebookCheck).