Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing object count limits.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-26T14:17:15.757Z",
  "pubdate": "2026-08-26T14:17:15.757Z",
  "executiveSummary": "A resource exhaustion vulnerability exists in GitLab CE/EE due to the absence of object count limits during background job processing.\nThis flaw allows an authenticated attacker to trigger a Denial of Service (DoS) condition by manipulating object counts to overwhelm the Sidekiq background processing infrastructure.\nThe vulnerability affects GitLab CE/EE versions 12.8 through 19.1.6, 19.2 through 19.2.4, and 19.3.0.\nBy exploiting the lack of input validation on object quantities, a malicious user can monopolize system resources, causing severe service degradation or complete failure of background job queues.\nSuccessful exploitation requires an authenticated session; however, no elevated administrative privileges are inherently described as a prerequisite.\nThe primary risk involves the disruption of critical asynchronous operations, which can paralyze platform functionalities such as repository management, CI/CD pipelines, and notification delivery systems.\nOrganizations are advised to prioritize the application of the provided security patches to enforce necessary object constraints and restore service stability.",
  "technicalDetails": "The vulnerability originates from a lack of input validation and rate-limiting logic concerning object counts during background job processing within the GitLab CE/EE application stack.\nIn GitLab, background tasks are managed via the Sidekiq framework, which processes various operations asynchronously. When an authenticated user initiates actions that require the instantiation or processing of a large number of objects without an upper bound constraint, the application backend becomes susceptible to resource exhaustion.\nThe root cause is the absence of a defensive mechanism to cap the number of objects a user can request the system to process simultaneously. By submitting crafted requests that force the application to iterate over or store an excessive number of objects, an attacker can trigger an 'out-of-memory' (OOM) state or lead to thread starvation within the Sidekiq worker processes.\nThe attack flow involves: 1) The attacker authenticates to the GitLab instance. 2) The attacker identifies a feature or API endpoint that processes user-controlled object collections. 3) The attacker crafts a request containing an exceptionally large number of elements or recursive structures. 4) The server-side code, failing to enforce limits on object counts, attempts to queue or process this payload via the background worker. 5) As the background job consumes excessive CPU and memory cycles, the worker process becomes unresponsive. 6) Repeated or concurrent requests lead to the saturation of the background job queue, effectively halting asynchronous operations for all users.\nAffected versions include all instances from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1. The vulnerability is network-accessible to any authenticated user, making it a critical threat to internal and external GitLab deployments.\nThe post-exploitation impact is a persistent Denial of Service affecting the background job infrastructure. Because modern GitLab functionality is heavily reliant on these background jobs for critical tasks like merge request updates, deployment triggers, and repository mirroring, the failure of the Sidekiq subsystem results in significant operational downtime, even if the primary web-facing frontend remains intermittently responsive."
}