CVE-2026-1092

CVE-2026-1092 is a denial of service vulnerability in GitLab Community Edition and Enterprise Edition that stems from improper input validation of JSON payloads. The flaw affects a broad range of versions including 12.10 through 18.8.8, 18.9.0 through 18.9.4, and 18.10.0 through 18.10.2, potentially impacting organizations running these releases. An unauthenticated attacker can exploit this vulnerability without authentication or user interaction by sending specially crafted JSON requests to a vulnerable GitLab instance. The vulnerability carries a CVSS v3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no privileges or user interaction, indicating a relatively easy exploitation path. The attack results in availability impact through denial of service, though confidentiality and integrity are not compromised. The FAUCET Risk Score of 48.0 out of 100 reflects moderate concern within the threat landscape. There is currently no evidence of active exploitation in the wild, as the CVE does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is marked as inactive on threat tracking lists. The exploitation probability score (EPSS) of 0.00039 is exceptionally low, suggesting minimal real-world exploit activity relative to other CVEs. Organizations should prioritize patching to versions 18.8.9, 18.9.5, or 18.10.3 and later as part of standard maintenance practices rather than emergency response.