Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
2867 articles · 109219 vulns · 38/41 feeds (7d)
← Back to list
6.5
CVE-2026-1101PATCHED
gitlab · gitlab

Improper Validation of Specified Quantity in Input in GitLab

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an authenticated user to cause denial of service to the GitLab instance due to improper input validation in GraphQL queries.

Affected Products

VendorProductVersions
gitlabgitlab18.2, 18.9, 18.10, 18.8.8, 18.9.4, 18.10.2

References

  • https://hackerone.com/reports/3460228(technical-description, exploit, permissions-required)
  • https://gitlab.com/gitlab-org/gitlab/-/work_items/586488
  • https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/

Related News (1 articles)

Tier C
VulDB5h ago
CVE-2026-1101 | GitLab Enterprise Edition up to 18.8.8/18.9.4/18.10.2 improper validation of specified quantity in input
→ No new info (linked only)
CVSS 3.16.5 HIGH
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CISA KEV❌ No
Actively exploited❌ No
Patch available
18.8.918.9.518.10.3
CWECWE-1284
PublishedApr 8, 2026
Last enriched4h agov2
Trending Score27
Source articles1
Independent1
Info Completeness9/14
Missing: epss, kev, exploit, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

CRITICALCVE-2025-12664EXP
Improper Validation of Specified Quantity in Input in GitLab
Trending: 49
CRITICALCVE-2026-1516EXP
Improper Control of Generation of Code ('Code Injection') in GitLab
Trending: 49
CRITICALCVE-2026-5173EXP
Exposed Dangerous Method or Function in GitLab
Trending: 49
HIGHCVE-2026-2104EXP
Authorization Bypass Through User-Controlled Key in GitLab
Trending: 46
HIGHCVE-2025-9484
Missing Authorization in GitLab
Trending: 27

Pin to Dashboard

Verification

State: unverified
Confidence: 0%

Vulnerability Timeline

CVE Published
Apr 8, 2026
Patch Available
Apr 8, 2026
Discovered by ZDM
Apr 8, 2026
Updated: affectedVersions, severity
Apr 9, 2026

Version History

v2
Last enriched 4h ago
v2Tier C4h ago

Updated affected versions to include 18.8.8, 18.9.4, and 18.10.2, changed severity to HIGH, and noted that no exploit is available.

affectedVersionsseverity
via VulDB
v15h ago

Initial creation