CVE-2026-1388
Inefficient Regular Expression Complexity in GitLab
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 7.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
25 feb 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint under certain conditions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
GitLab · GitLab¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →