CVE-2026-100755

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.2 through 19.2.7 GitLab CE/EE versions 19.3 through 19.3.4 GitLab CE/EE versions 19.4 through 19.4.1

Description Under certain deployment configurations, an authenticated user can poison cached page content served to other users. This occurs due to improper cache key construction, which allows the acceptance of extraneous untrusted data combined with trusted data.

Recommendations Update GitLab CE/EE to version 19.2.8 or later. Update GitLab CE/EE to version 19.3.5 or later. Update GitLab CE/EE to version 19.4.2 or later.