High · published February 11, 2026
⚡ An unauthenticated user can trigger a denial of service by exploiting GitLab's JSON validation limits — talk about a surprise party nobody wants! 🎉 Think of it like a restaurant where diners can order an unlimited amount of food without paying — eventually, the kitchen becomes overwhelmed, and no one gets served. Here, attackers are throwing endless requests to GitLab, causing the system to slow down to a crawl, or worse, crash entirely. This vulnerability could lead to total chaos on your GitLab instance, with legitimate users unable to access their projects or work — a frustrating scenario that could stall development and waste precious time. An attacker could effectively render the service unusable, impacting productivity and trust.
Think of it like a restaurant where diners can order an unlimited amount of food without paying — eventually, the kitchen becomes overwhelmed, and no one gets served. Here, attackers are throwing endless requests to GitLab, causing the system to slow down to a crawl, or worse, crash entirely. CVE-2026-0958 exists in GitLab CE/EE versions 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4. It allows unauthenticated users to bypass JSON validation middleware, leading to memory or CPU exhaustion and denial of service.
This vulnerability could lead to total chaos on your GitLab instance, with legitimate users unable to access their projects or work — a frustrating scenario that could stall development and waste precious time. An attacker could effectively render the service unusable, impacting productivity and trust. Upgrade your GitLab instance to version 18.6.6, 18.7.4, or 18.8.4 to close this vulnerability. Regularly monitor and limit resource usage as an additional precaution to prevent such attacks in the future. Don't forget to conduct a security review of your setup! You've got this! Stay secure and keep your GitLab humming smoothly! 🛡️