Loading vulnerability…
Denial of Service in GitLab Terraform State Lock API
CVE-2026-1092 is a denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition affecting all versions from 12.10 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3. The flaw is in the Terraform state lock API, where JSON payloads were insufficiently validated before processing and parsing occurred before authentication checks were fully enforced. As a result, an unauthenticated remote attacker could submit malformed, oversized, or deeply nested JSON input that forces the server to expend excessive resources while handling the request. The issue is associated with improper validation of quantitative properties in input and can be triggered without valid credentials.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause resource exhaustion on the GitLab server, including excessive CPU and memory consumption, resulting in denial of service. Because the vulnerable endpoint is reachable prior to effective authentication enforcement, unauthenticated attackers can repeatedly send crafted requests to disrupt availability for legitimate users. In environments using GitLab as a backend for Terraform or OpenTofu state management, this can stall state lock operations, interrupt infrastructure workflows, and disrupt automated deployment pipelines.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure to the Terraform state lock API by restricting network access to trusted clients, especially on internet-facing self-managed instances. Enforce request body size and parsing limits at reverse proxies, load balancers, or web application firewalls to block oversized or excessively nested JSON payloads before they reach GitLab. Monitor logs and infrastructure telemetry for anomalous traffic patterns and repeated requests targeting Terraform state lock operations, and rate-limit abusive clients where feasible. These measures only reduce risk and do not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release: 18.8.9 or later on the 18.8 patch line, 18.9.5 or later on the 18.9 patch line, or 18.10.3 or later on the 18.10 patch line. These releases introduce stricter validation of JSON payload structure and size for the Terraform state lock API before request processing proceeds. Self-managed deployments must apply the vendor patches manually; hosted GitLab.com instances were already patched.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.