CVE-2026-1662
Published: 25 February 2026
Summary
CVE-2026-1662 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Gitlab Gitlab. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application Exhaustion Flood (T1499.003); ranked at the 16.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-1662 is a denial-of-service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE), affecting all versions from 14.4 prior to 18.7.5, 18.8 prior to 18.8.5, and 18.9 prior to 18.9.1. The flaw enables an unauthenticated user to trigger a DoS condition by sending specially crafted requests to the Jira events endpoint. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is linked to CWE-770 (Allocation of Resources Without Limits or Throttling).
An unauthenticated attacker with network access can exploit this vulnerability with low attack complexity and no user interaction. Exploitation involves sending malformed requests to the affected endpoint, leading to high-impact resource exhaustion and service disruption on vulnerable GitLab instances, without affecting confidentiality or integrity.
GitLab has remediated the issue through patches released in versions 18.7.5, 18.8.5, and 18.9.1, as detailed in the February 25, 2026 patch release notes for GitLab 18.9.1. Additional technical details and the remediation discussion are available in GitLab issue 588206 and HackerOne report 3519694. Security teams should prioritize upgrading affected instances to mitigate exposure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8722
Vulnerability details
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.4 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause Denial of Service by sending specially crafted requests to…
more
the Jira events endpoint.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables application-layer resource exhaustion DoS via crafted requests to a public endpoint (CWE-770).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents denial-of-service attacks like CVE-2026-1662 by implementing resource throttling and limits on specially crafted requests to the Jira events endpoint.
Addresses the specific flaw in GitLab's Jira events endpoint by requiring timely patching to versions 18.7.5, 18.8.5, or 18.9.1, eliminating the unthrottled resource allocation vulnerability.
Mitigates exploitation of specially crafted requests causing resource exhaustion by validating inputs to the unauthenticated Jira events endpoint.