CVE-2026-1456 — Allocation of Resources Without Limits or Throttling in Gitlab

CWE-770 — Allocation of Resources Without Limits or ThrottlingCWE-407 — Inefficient Algorithmic Complexity7 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.0%
top 89.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
GitlabCode.vikunja.io APIDebian Gitlab+1 more
Timeline
PublishedFeb 11
Latest updateApr 10

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through CPU exhaustion by submitting specially crafted markdown files that trigger exponential processing in markdown preview.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶CVEListV5gitlab/gitlab18.7 — 18.7.4+1
▶NVDgitlab/gitlab18.7.0 — 18.7.4+1
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

3
GHSA
Vikunja has Algorithmic Complexity DoS in Repeating Task Handler↗2026-04-10
▶
OSV
CVE-2026-1456: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18↗2026-02-11
▶
GHSA
GHSA-w487-9r9p-6p96: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18↗2026-02-11
▶

📋Vendor Advisories

2
GitLab
CVE-2026-1456: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unaut↗2026-02-11
▶
Debian
CVE-2026-1456: gitlab - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 ...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-1456 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶