CVE-2026-77801— Allocation of Resources Without Limits or Throttling in GitLab
Quick assessment
Affected
GitLab GitLab
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GitLab 已修复 GitLab CE/EE 中影响 12.8 至 19.1.7 之前、19.2 至 19.2.5 之前以及 19.3 至 19.3.1 之前所有版本的漏洞。在特定条件下，由于缺少对象数量限制，经过身份验证的用户可能导致背景任务处理出现服务中断（拒绝服务）。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77801
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Allocation of Resources Without Limits or Throttling in GitLab
Source: CVE Program / CVE List V5
Vulnerability Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing object count limits.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-77801
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-77801
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-77801 (2)
Same Patch Batch · GitLab · 2026-08-26 · 6 CVEs total
| CVE-2026-18252 | 7.3 HIGH | Inclusion of Functionality from Untrusted Control Sphere in GitLab |
| CVE-2025-10903 | 6.5 MEDIUM | Loop with Unreachable Exit Condition ('Infinite Loop') in GitLab |
| CVE-2026-3035 | 5.5 MEDIUM | Authentication Bypass Using an Alternate Path or Channel in GitLab |
| CVE-2026-15387 | 4.3 MEDIUM | Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab |
| CVE-2026-7487 | 3.5 LOW | Access Control Check Implemented After Asset is Accessed in GitLab |
IV. Related Vulnerabilities
Same product: GitLab
-
CVE-2025-10903
Loop with Unreachable Exit Condition ('Infinite Loop') in Gi -
CVE-2026-3035
Authentication Bypass Using an Alternate Path or Channel in -
CVE-2026-7487
Access Control Check Implemented After Asset is Accessed in -
CVE-2026-15387
Acceptance of Extraneous Untrusted Data With Trusted Data in -
CVE-2026-18252
Inclusion of Functionality from Untrusted Control Sphere in
Same vendor: GitLab
-
CVE-2025-10903
Loop with Unreachable Exit Condition ('Infinite Loop') in Gi -
CVE-2026-3035
Authentication Bypass Using an Alternate Path or Channel in -
CVE-2026-7487
Access Control Check Implemented After Asset is Accessed in -
CVE-2026-15387
Acceptance of Extraneous Untrusted Data With Trusted Data in -
CVE-2026-18252
Inclusion of Functionality from Untrusted Control Sphere in
Same weakness: CWE-770
-
CVE-2026-61617
Pterodactyl Wings SFTP write path does not enforce disk quot -
CVE-2026-79921
amqp091-go has a Potential Memory Exhaustion/Protocol Violat -
CVE-2026-73108
RustDesk < 1.4.7 Uncontrolled Memory Allocation DoS via Byte -
CVE-2026-55620
eml_parser: DoS via deeply nested parens in Received headers -
CVE-2026-55619
eml_parser: Parser DoS via deeply nested parentheses in e-ma
V. Comments for CVE-2026-77801
No comments yet