GCVE-110-NCSC-2026-72

Advisory PublishedCVSS 6.5/10

Vulnetix · Advisory published February 27, 2026

GitLab addressed a vulnerability in versions 9.2 to before 18.7.5, 18.8 to before 18.8.5, and 18.9 to before 18.9.1 that allowed unauthenticated users to cause a regular expression denial of service via crafted input to a merge request endpoint.

Download JSON Open in Console

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or ThrottlingCWE-862Missing AuthorizationCWE-1284Improper Validation of Specified Quantity in InputCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-1333Inefficient Regular Expression ComplexityCWE-288Authentication Bypass Using an Alternate Path or Channel

Risk Scores

CVSS 3.1

6.5/10

Medium · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions	Platforms
GitLab	vers:unknown/*	—	—

Aliases

CVE-2025-14103 CVE-2025-14511 CVE-2025-3525 CVE-2026-0752 CVE-2026-1388 CVE-2026-1662 CVE-2026-1725 CVE-2026-1747 CVE-2026-2845

References

advisory

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON