Cyber Resilience

CVE-2026-1662

HighDDoS

Published: 25 February 2026

Published
25 February 2026
Modified
28 February 2026
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0005 16.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1662 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Gitlab Gitlab. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application Exhaustion Flood (T1499.003); ranked at the 16.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-1662 is a denial-of-service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE), affecting all versions from 14.4 prior to 18.7.5, 18.8 prior to 18.8.5, and 18.9 prior to 18.9.1. The flaw enables an unauthenticated user to trigger a DoS condition by sending specially crafted requests to the Jira events endpoint. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is linked to CWE-770 (Allocation of Resources Without Limits or Throttling).

An unauthenticated attacker with network access can exploit this vulnerability with low attack complexity and no user interaction. Exploitation involves sending malformed requests to the affected endpoint, leading to high-impact resource exhaustion and service disruption on vulnerable GitLab instances, without affecting confidentiality or integrity.

GitLab has remediated the issue through patches released in versions 18.7.5, 18.8.5, and 18.9.1, as detailed in the February 25, 2026 patch release notes for GitLab 18.9.1. Additional technical details and the remediation discussion are available in GitLab issue 588206 and HackerOne report 3519694. Security teams should prioritize upgrading affected instances to mitigate exposure.

EU & UK References

Vulnerability details

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to…

more

the Jira events endpoint.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
Why these techniques?

Directly enables application-layer resource exhaustion DoS via crafted requests to a public endpoint (CWE-770).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-1456Same product: Gitlab Gitlab
CVE-2025-8099Same product: Gitlab Gitlab
CVE-2025-1257Same product: Gitlab Gitlab
CVE-2025-13929Same product: Gitlab Gitlab
CVE-2026-1102Same product: Gitlab Gitlab
CVE-2025-13927Same product: Gitlab Gitlab
CVE-2026-1725Same product: Gitlab Gitlab
CVE-2024-2878Same product: Gitlab Gitlab
CVE-2025-14870Same product: Gitlab Gitlab
CVE-2026-1659Same product: Gitlab Gitlab

Affected Assets

gitlab
gitlab
18.9.0 · 14.4.0 — 18.7.5 · 14.4.0 — 18.7.5 · 18.8.0 — 18.8.5

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly prevents denial-of-service attacks like CVE-2026-1662 by implementing resource throttling and limits on specially crafted requests to the Jira events endpoint.

prevent

Addresses the specific flaw in GitLab's Jira events endpoint by requiring timely patching to versions 18.7.5, 18.8.5, or 18.9.1, eliminating the unthrottled resource allocation vulnerability.

prevent

Mitigates exploitation of specially crafted requests causing resource exhaustion by validating inputs to the unauthenticated Jira events endpoint.

References