Cyber Posture

CVE-2026-1662

High

Published: 25 February 2026

Published
25 February 2026
Modified
28 February 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0005 15.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1662 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Gitlab Gitlab. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application Exhaustion Flood (T1499.003); ranked at the 15.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Application Exhaustion Flood (T1499.003).
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-770

This control implements explicit throttling on session allocation, addressing the weakness of allocating resources without limits.

addresses: CWE-770

Plan testing exercises resource allocation limits and throttling during simulated failures, directly addressing weaknesses that allow unbounded resource use.

addresses: CWE-770

Contingency plan updates ensure recovery strategies address unbounded resource allocation, making it harder for attackers to exploit lack of throttling to cause prolonged outages.

addresses: CWE-770

Provides continuity when unbounded resource allocation at the primary site leads to exhaustion and downtime.

addresses: CWE-770

Alternate services allow operations to continue when primary allocation of resources lacks limits or throttling.

addresses: CWE-770

Explicit planning of security-related actions requires defining limits, windows, and resource allocations, making allocation without throttling far less likely.

addresses: CWE-770

Measures of performance include tracking allocation behavior and throttling effectiveness, reducing the window for resource exhaustion attacks.

addresses: CWE-770

Imposes an inactivity-based limit on network resource allocation, throttling the number of concurrently held connections.

MITRE ATT&CK Enterprise TechniquesAI

T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
Why these techniques?

Directly enables application-layer resource exhaustion DoS via crafted requests to a public endpoint (CWE-770).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to…

more

the Jira events endpoint.

Deeper analysisAI

CVE-2026-1662 is a denial-of-service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE), affecting all versions from 14.4 prior to 18.7.5, 18.8 prior to 18.8.5, and 18.9 prior to 18.9.1. The flaw enables an unauthenticated user to trigger a DoS condition by sending specially crafted requests to the Jira events endpoint. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is linked to CWE-770 (Allocation of Resources Without Limits or Throttling).

An unauthenticated attacker with network access can exploit this vulnerability with low attack complexity and no user interaction. Exploitation involves sending malformed requests to the affected endpoint, leading to high-impact resource exhaustion and service disruption on vulnerable GitLab instances, without affecting confidentiality or integrity.

GitLab has remediated the issue through patches released in versions 18.7.5, 18.8.5, and 18.9.1, as detailed in the February 25, 2026 patch release notes for GitLab 18.9.1. Additional technical details and the remediation discussion are available in GitLab issue 588206 and HackerOne report 3519694. Security teams should prioritize upgrading affected instances to mitigate exposure.

Details

CWE(s)

Affected Products

gitlab
gitlab
18.9.0 · 14.4.0 — 18.7.5 · 14.4.0 — 18.7.5 · 18.8.0 — 18.8.5

CVEs Like This One

CVE-2026-1456Same product: Gitlab Gitlab
CVE-2025-8099Same product: Gitlab Gitlab
CVE-2025-13927Same product: Gitlab Gitlab
CVE-2025-1257Same product: Gitlab Gitlab
CVE-2024-2878Same product: Gitlab Gitlab
CVE-2026-1725Same product: Gitlab Gitlab
CVE-2026-1102Same product: Gitlab Gitlab
CVE-2025-13929Same product: Gitlab Gitlab
CVE-2026-1458Same product: Gitlab Gitlab
CVE-2024-9631Same product: Gitlab Gitlab

References