CVE-2026-77801: gitlab

CVSS: 6.5v3.1MediumAnalyzed

AliasesCGA-49mm-5wpj-vr8mCGA-4xp3-459x-6phcCGA-5qfr-r2jv-52g4+203 more

Published 26-08-2026Last modified 26-08-2026

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2026-77801 is a medium (CVSS 6.5) vulnerability in gitlab. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.7% of scored vulnerabilities.

Overall risk

26/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.43%

0%100%

Low · +0.09 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1

CGA-669W-MH6H-FVFX

Timeline

26-08-2026
PublishedVulnerability first disclosed.
26-08-2026
Last modifiedVulnerability information updated.

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing object count limits.

CVSS metrics

4 scores · 4 sources · 1 version

v3.16.5

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

36%

Versus all other CVEs

30-day change

+0.09 pp

From 0.34% on 21-09-2026

21-09-202621-10-2026

EPSS score

0.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Chainguard103 products

gitaly-config-19.0< 19.0.8-r5
gitlab-agent-19.2< 19.2.5-r0
gitlab-base-19.0< 19.0.8-r5
gitlab-base-fips-19.0< 19.0.8-r2
gitlab-certificates-19.0< 19.0.8-r5

gitlab-cfssl-self-sign-scripts-19.0< 19.0.8-r5
gitlab-cng-19.0< 19.0.8-r5
gitlab-cng-fips-19.0< 19.0.8-r2
gitlab-container-registry-19.0< 19.0.8-r5
gitlab-container-registry-fips-19.0< 19.0.8-r2
gitlab-container-registry-scripts-19.0< 19.0.8-r5
gitlab-docker-machine-19.1< 19.1.2-r5
gitlab-docker-machine-19.2< 19.2.3-r1
gitlab-docker-machine-fips-19.1< 19.1.2-r3
gitlab-docker-machine-fips-19.2< 19.2.3-r1
gitlab-exporter-19.0< 19.0.8-r5
gitlab-exporter-scripts-19.0< 19.0.8-r5
gitlab-gitaly-scripts-19.0< 19.0.8-r5
gitlab-kas-19.2< 19.2.5-r0
gitlab-logger-19.0< 19.0.8-r5
gitlab-logger-fips-19.0< 19.0.8-r2
gitlab-pages-scripts-19.0< 19.0.8-r5
gitlab-rails-ce-18.10< 18.10.8-r6
gitlab-rails-ce-18.11< 18.11.11-r1
gitlab-rails-ce-18.7< 18.7.7-r5
gitlab-rails-ce-18.8< 18.8.11-r7
gitlab-rails-ce-18.9< 18.9.8-r10
gitlab-rails-ce-19.0< 19.0.8-r3
gitlab-rails-ce-assets-18.10< 18.10.8-r6
gitlab-rails-ce-assets-18.11< 18.11.11-r1
gitlab-rails-ce-assets-18.7< 18.7.7-r5
gitlab-rails-ce-assets-18.8< 18.8.11-r7
gitlab-rails-ce-assets-18.9< 18.9.8-r10
gitlab-rails-ce-assets-19.0< 19.0.8-r3
gitlab-rails-ce-assets-fips-18.10< 18.10.8-r7
gitlab-rails-ce-assets-fips-18.11< 18.11.11-r1
gitlab-rails-ce-assets-fips-18.7< 18.7.7-r6
gitlab-rails-ce-assets-fips-18.8< 18.8.11-r7
gitlab-rails-ce-assets-fips-18.9< 18.9.8-r7
gitlab-rails-ce-assets-fips-19.0< 19.0.8-r1
gitlab-rails-ce-doc-18.10< 18.10.8-r6
gitlab-rails-ce-doc-18.11< 18.11.11-r1
gitlab-rails-ce-doc-18.7< 18.7.7-r5
gitlab-rails-ce-doc-18.8< 18.8.11-r7
gitlab-rails-ce-doc-18.9< 18.9.8-r10
gitlab-rails-ce-doc-19.0< 19.0.8-r3
gitlab-rails-ce-doc-fips-18.10< 18.10.8-r7
gitlab-rails-ce-doc-fips-18.11< 18.11.11-r1
gitlab-rails-ce-doc-fips-18.7< 18.7.7-r6
gitlab-rails-ce-doc-fips-18.8< 18.8.11-r7
gitlab-rails-ce-doc-fips-18.9< 18.9.8-r7
gitlab-rails-ce-doc-fips-19.0< 19.0.8-r1
gitlab-rails-ce-fips-18.10< 18.10.8-r7
gitlab-rails-ce-fips-18.11< 18.11.11-r1
gitlab-rails-ce-fips-18.7< 18.7.7-r6
gitlab-rails-ce-fips-18.8< 18.8.11-r7
gitlab-rails-ce-fips-18.9< 18.9.8-r7
gitlab-rails-ce-fips-19.0< 19.0.8-r1
gitlab-rails-scripts-19.0< 19.0.8-r5
gitlab-rails-scripts-fips-19.0< 19.0.8-r2
gitlab-runner-19.1< 19.1.2-r5
gitlab-runner-19.2< 19.2.3-r1
gitlab-runner-fips-19.1< 19.1.2-r3
gitlab-runner-fips-19.2< 19.2.3-r1
gitlab-runner-helper-19.1< 19.1.2-r5
gitlab-runner-helper-19.2< 19.2.3-r1
gitlab-runner-helper-compat-19.1< 19.1.2-r5
gitlab-runner-helper-compat-19.2< 19.2.3-r1
gitlab-runner-helper-compat-fips-19.1< 19.1.2-r3
gitlab-runner-helper-compat-fips-19.2< 19.2.3-r1
gitlab-runner-helper-fips-19.1< 19.1.2-r3
gitlab-runner-helper-fips-19.2< 19.2.3-r1
gitlab-runner-helper-oci-entrypoint-19.1< 19.1.2-r5
gitlab-runner-helper-oci-entrypoint-19.2< 19.2.3-r1
gitlab-runner-helper-oci-entrypoint-fips-19.1< 19.1.2-r3
gitlab-runner-helper-oci-entrypoint-fips-19.2< 19.2.3-r1
gitlab-runner-oci-entrypoint-19.1< 19.1.2-r6
gitlab-runner-oci-entrypoint-19.2< 19.2.3-r1
gitlab-runner-oci-entrypoint-fips-19.1< 19.1.2-r3
gitlab-runner-oci-entrypoint-fips-19.2< 19.2.3-r1
gitlab-shell-19.0< 19.0.8-r5
gitlab-shell-fips-19.0< 19.0.8-r2
gitlab-shell-scripts-19.0< 19.0.8-r5
gitlab-sidekiq-ce-19.0< 19.0.8-r5
gitlab-sidekiq-ce-fips-19.0< 19.0.8-r2
gitlab-toolbox-ce-19.0< 19.0.8-r5
gitlab-toolbox-ce-fips-19.0< 19.0.8-r2
gitlab-webservice-ce-19.0< 19.0.8-r5
gitlab-webservice-ce-fips-19.0< 19.0.8-r2
gitlab-workhorse-ce-18.10< 18.10.8-r6
gitlab-workhorse-ce-18.11< 18.11.11-r3
gitlab-workhorse-ce-18.7< 18.7.7-r8
gitlab-workhorse-ce-18.8< 18.8.11-r5
gitlab-workhorse-ce-18.9< 18.9.8-r9
gitlab-workhorse-ce-19.0< 19.0.8-r2
gitlab-workhorse-ce-fips-18.10< 18.10.8-r6
gitlab-workhorse-ce-fips-18.11< 18.11.11-r1
gitlab-workhorse-ce-fips-18.7< 18.7.7-r7
gitlab-workhorse-ce-fips-18.8< 18.8.11-r7
gitlab-workhorse-ce-fips-18.9< 18.9.8-r8
gitlab-workhorse-ce-fips-19.0< 19.0.8-r1
gitlab-workhorse-scripts-19.0< 19.0.8-r5
gitlab-workhorse-scripts-fips-19.0< 19.0.8-r2

Show all 103

Wolfi14 products

gitlab-agent-19.2< 19.2.5-r0
gitlab-docker-machine-19.1< 19.1.2-r5
gitlab-docker-machine-19.2< 19.2.3-r1
gitlab-kas-19.2< 19.2.5-r0
gitlab-runner-19.1< 19.1.2-r5

Show all 14

Gitlab1 product

gitlab≥ 12.8, < 19.1.7 | ≥ 19.2, < 19.2.5 | ≥ 19.3, < 19.3.1 | ≥ 12.8.0, < 19.1.7 | ≥ 19.2.0, < 19.2.5 | 19.3.0

3 vendors · 118 products

References

4 links

gitlab.com/gitlab-org/gitlab/-/work_items/597273WEBIssue TrackingPermissions Required
docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/WEBRelease NotesVendor Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77801.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-77801Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities