PT-2026-21994

CVE-2026-1388

Published

2026-02-25

Updated

2026-03-02

Description by

CVSS 2.0

7.8

High

MetricsAV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 9.2 through 18.7.4 GitLab CE/EE versions 18.8 through 18.8.4 GitLab CE/EE versions 18.9 through 18.9.0

Description An unauthenticated user could potentially cause a denial of service by sending specially crafted input to a merge request endpoint. This issue involves a regular expression denial of service.

Recommendations Update GitLab CE/EE to version 18.7.5 or later. Update GitLab CE/EE to version 18.8.5 or later. Update GitLab CE/EE to version 18.9.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Sim4N6

Vendors

Affected products

Weakness enumeration

CWE-1333: Inefficient Regular Expression Complexity

Related identifiers

CVE-2026-1388