CVE-2026-3988Disclosure(gitlab / gitlab)

LOWCVSS 7.5 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Patch gitlab gitlab systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an unauthenticated user to cause a denial of service by making the GitLab instance unresponsive due to improper input validation in GraphQL request processing.

0.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-407

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • gitlab

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 3 total mentions across 1 day

Affected systems

Vendors
Products
gitlab

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-03-25: 3Patch / Workaround · 2026-03-25: 1Technical Details · 2026-03-25: 303-25
Signal classification3 categories
Disclosure
133.3%
General
133.3%
Patch
133.3%
Referenced assets4 URLs
Full discourse3 posts
  • CVE@CVEnew
    Patch

    CVE-2026-3988 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an u… https://www.cve.org/CVERecord?id=CVE-2026-3988

    Post summary

    GitLab has issued a remediation for CVE-2026‑3988 across multiple major releases, with no reported active exploitation or PoC evidence.

    00010168
    56.8K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-3988 GraphQL Denial of Service Vulnerability in GitLab CE/EE Multiple V... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3988 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    The tweet announces CVE-2026-3988 as a GraphQL Denial of Service vulnerability affecting GitLab CE/EE and provides a link to detail the alert, but offers no PoC, exploit, patch, or evidence of active exploitation.

    0000060
    4.0K followersView on X
  • CyberDudeBivash® | Global Cybersecurity Company@cyberbivash
    Disclosure

    🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-3988 - Inefficient Algorithmic Complexity in GitLab Intel Report: https://ift.tt/9od72rs

    Post summary

    The alert introduces CVE‑2026‑3988 as an inefficient algorithmic complexity issue in GitLab, without providing exploit details, active exploitation evidence, or patch information.

    0000034
    286 followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
Appgitlabgitlab---
Appgitlabgitlab---
Appgitlabgitlab18.10.0--
Appgitlabgitlab18.10.0--

Explore more