CVE-2026-1168

CVE-2026-1168 is a denial-of-service flaw in GitLab CE/EE caused by improper resource allocation limits in the GraphQL complexity calculation logic (CWE-770). An unauthenticated attacker can send crafted GraphQL queries to a GitLab instance and, under certain conditions, exhaust server resources and render the instance unavailable. The attacker gains no code execution or data access — the impact is availability only, but the CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N) reflects that exploitation requires only network access with no privileges or user interaction. All self-managed GitLab CE and EE deployments in the affected version ranges are exposed, particularly those with the GraphQL API reachable from the internet. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; remediation is available in patched releases.

What to do: Upgrade self-managed GitLab CE/EE to 19.1.8, 19.2.6, or 19.3.2 (or later), depending on your current release branch. As an interim mitigation, restrict the GraphQL endpoint (/api/graphql) to trusted networks or authenticated clients at the reverse proxy and apply rate limiting to blunt resource-exhaustion attempts. Monitor CPU/memory usage and instance availability for signs of abuse, and check the GitLab version shown in /api/v4/version or /help to confirm you are out of the affected ranges.