Description

GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the SCIM user provisioning feature.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-26T14:17:06.597Z",
  "pubdate": "2026-08-26T14:17:06.597Z",
  "executiveSummary": "This vulnerability involves an unbounded loop condition within the SCIM (System for Cross-domain Identity Management) user provisioning feature of GitLab EE. The flaw allows an authenticated attacker to trigger a denial of service (DoS) by submitting specially crafted input to the provisioning interface.\nThe vulnerability affects GitLab EE versions 11.10 through 19.1.6, 19.2.0 through 19.2.4, and 19.3.0. By exploiting the logic error in request processing, an attacker can exhaust system resources, leading to service unavailability.\nThe risk is categorized as a service availability threat. Successful exploitation requires the attacker to possess authenticated access to the GitLab instance. There is no evidence of remote code execution or data exfiltration associated with this flaw; however, the impact on system stability and availability is significant for organizations relying on SCIM integration for identity lifecycle management.",
  "technicalDetails": "The vulnerability originates in the SCIM user provisioning module within GitLab EE, specifically in the logic responsible for parsing and processing incoming SCIM requests. The root cause is an input validation failure that fails to restrict or terminate processing cycles when presented with malicious or malformed payload structures.\nThe flaw manifests as an unbounded loop, wherein the application enters a state of infinite recursion or repetitive processing upon receiving a specific, crafted input string. Because the SCIM feature handles identity data synchronization, the process responsible for handling these requests runs with application-level privileges. When the unbounded loop is triggered, the worker process consumes CPU cycles and memory resources until the system exhausts its allocated resources for that specific request thread or process.\nThe attack flow proceeds as follows: First, an authenticated attacker identifies the SCIM provisioning endpoint. Second, the attacker constructs a serialized SCIM request object that bypasses internal length or structure constraints, specifically targeting the parser's recursive logic. Third, the attacker transmits this crafted payload to the GitLab EE instance. Finally, the application, upon attempting to process the malformed input, enters the unbounded loop. This results in the consumption of system resources, eventually causing the specific worker process to hang, time out, or potentially crash, thereby preventing further SCIM operations or affecting overall instance performance depending on the application server configuration.\nVulnerable versions include all instances of GitLab EE from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1. The requirement for authentication limits the attack surface to registered users, but given the nature of SCIM, this often includes internal users or potentially compromised service accounts. The vulnerability is highly effective at inducing resource starvation, which can cascade into a service-wide outage if the affected processes are critical to core GitLab functionality or if the process pool is exhausted by concurrent malicious requests."
}