Loading vulnerability…
Unauthenticated DoS in GitLab CI/CD Job Update API
CVE-2026-1659 is a denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition affecting self-managed instances. The flaw is present in the CI/CD job update API and is caused by insufficient input validation and uncontrolled resource allocation when processing specially crafted requests. Affected versions include all releases from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. The vulnerable request-handling logic can be abused remotely by an unauthenticated attacker to trigger excessive resource consumption, resulting in service degradation or outage.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can exhaust server resources and cause a denial-of-service condition with high availability impact. Confidentiality and integrity impacts are not indicated. On affected self-managed GitLab deployments, exploitation can disrupt GitLab availability, including CI/CD pipeline operations and related engineering workflows.
If you can’t patch tonight, do this now.
No official workaround was documented other than upgrading to a fixed version. Where immediate patching is not possible, reducing anonymous network exposure to the affected API surface may lower risk, but this is not a vendor-stated fix and should not be treated as a substitute for upgrading.
Patch, then assume compromise.
Upgrade self-managed GitLab CE/EE installations to a fixed release. The issue is remediated in 18.9.7, 18.10.6, and 18.11.3. GitLab.com and GitLab Dedicated were already addressed by the vendor at the time of disclosure. The patch adds bounds checking and resource allocation constraints to the CI/CD job update API request-handling logic.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.