Loading vulnerability…
Unauthenticated denial of service in GitLab SSH authentication API
CVE-2026-1102 is a denial-of-service vulnerability in a GitLab Community Edition and Enterprise Edition API endpoint handling SSH authentication requests. An unauthenticated attacker could trigger a denial-of-service condition by sending repeated malformed SSH authentication requests. Affected versions are 12.3 through versions before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2. The underlying implementation defect and vulnerable function are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could degrade or interrupt GitLab service availability. The extent and duration of disruption are not specified.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure to the affected SSH authentication handling path by restricting network access to trusted sources, placing the service behind filtering or rate-limiting controls, and monitoring for repeated malformed SSH authentication attempts that could indicate exploitation. These measures may reduce exploitability but do not fully remediate the underlying flaw.
Patch, then assume compromise.
Upgrade affected GitLab CE/EE installations to 18.6.4, 18.7.2, or 18.8.2, as appropriate for the release branch, or a later fixed release. These updates include database migrations that may cause downtime on single-node installations; multi-node deployments can use GitLab's zero-downtime upgrade procedures. GitLab.com was already patched at release time, and GitLab Dedicated customers required no action.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.