Cyber Resilience

CVE-2026-1069

HighDDoS

Published: 11 March 2026

Published
11 March 2026
Modified
13 March 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0003 10.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1069 is a high-severity Uncontrolled Recursion (CWE-674) vulnerability in Gitlab Gitlab. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-1069 is a denial-of-service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE), affecting all versions from 18.9 prior to 18.9.2. The issue stems from uncontrolled recursion (CWE-674) triggered by specially crafted GraphQL requests under certain circumstances, allowing resource exhaustion. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and was published on 2026-03-11.

An unauthenticated attacker can exploit this vulnerability remotely with low complexity by sending malicious GraphQL queries to a vulnerable GitLab instance. Successful exploitation results in denial of service through excessive resource consumption, potentially disrupting service availability without impacting confidentiality or integrity.

GitLab remediated the issue in version 18.9.2, as detailed in their patch release notes. Additional details are available in the associated GitLab work item and HackerOne disclosure report. Security practitioners should upgrade to 18.9.2 or later to mitigate the risk.

EU & UK References

Vulnerability details

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by sending specially crafted GraphQL requests due to uncontrolled recursion under certain…

more

circumstances.

CWE(s)
CWE-674

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Unauthenticated remote exploitation of public-facing GitLab via crafted GraphQL input directly enables application-layer DoS through resource exhaustion.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-1257Same product: Gitlab Gitlab
CVE-2025-13928Same product: Gitlab Gitlab
CVE-2026-1458Same product: Gitlab Gitlab
CVE-2025-13929Same product: Gitlab Gitlab
CVE-2026-1102Same product: Gitlab Gitlab
CVE-2026-1092Same product: Gitlab Gitlab
CVE-2025-13927Same product: Gitlab Gitlab
CVE-2024-9631Same product: Gitlab Gitlab
CVE-2025-14513Same product: Gitlab Gitlab
CVE-2026-0723Same product: Gitlab Gitlab

Affected Assets

gitlab
gitlab
18.9.0 — 18.9.2 · 18.9.0 — 18.9.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Validates GraphQL query inputs to block specially crafted requests that trigger uncontrolled recursion and resource exhaustion.

SC-5 Denial-of-service Protection good match
prevent

Implements denial-of-service protections such as rate limiting to mitigate resource exhaustion from unauthenticated GraphQL requests.

SI-2 Flaw Remediation good match
prevent

Ensures timely flaw remediation by applying patches like GitLab 18.9.2 to fix the uncontrolled recursion vulnerability.

References