CVE-2026-1387

{"id": "CVE-2026-1387", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1387", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T21:17:22.725712Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@gitlab.com", "affectedData": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "15.6", "lessThan": "18.6.6", "versionType": "semver"}, {"status": "affected", "version": "18.7", "lessThan": "18.7.4", "versionType": "semver"}, {"status": "affected", "version": "18.8", "lessThan": "18.8.4", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-02-11T12:16:04.547", "references": [{"url": "https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/587546", "tags": ["Broken Link", "Issue Tracking"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/3515994", "tags": ["Broken Link"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab EE affecting all versions from 15.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an authenticated user to cause Denial of Service by uploading a malicious file and repeatedly querying it through GraphQl."}, {"lang": "es", "value": "GitLab ha remediado un problema en GitLab EE que afecta a todas las versiones desde la 15.6 anterior a la 18.6.6, la 18.7 anterior a la 18.7.4, y la 18.8 anterior a la 18.8.4 que podr\u00eda haber permitido a un usuario autenticado causar una denegaci\u00f3n de servicio al subir un archivo malicioso y consultarlo repetidamente a trav\u00e9s de GraphQl."}], "lastModified": "2026-06-17T10:15:41.383", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "3F0CFD5D-2A9D-49FD-A315-392CB1E1277F", "versionEndExcluding": "18.6.6", "versionStartIncluding": "15.6.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "DA7B13F4-05B9-436E-A1DC-6C65DB7B44FE", "versionEndExcluding": "18.7.4", "versionStartIncluding": "18.7.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "6D01D64A-0619-427D-B351-4101FC257674", "versionEndExcluding": "18.8.4", "versionStartIncluding": "18.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}