CVE-2026-0958

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allowed an unauthenticated user to cause denial of service through memory or CPU exhaustion by bypassing JSON validation middleware limits.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-436

Affected software

No affected versions have been published.

Timeline

Published: Feb 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-09596.5IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service CVE-2026-09605.5HTTP3 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.2 allows denial of service CVE-2026-09616.5BLF file parser crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service CVE-2026-09626.5SOME/IP-SD protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service CVE-2026-09638.8An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated atta CVE-2026-09646.3A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. T CVE-2026-09653.3A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by p CVE-2026-09668.2A flaw was found in libssh. The API function `ssh_get_hexa()` is vulnerable to a denial of service when processing zero-length input. This c CVE-2026-09675.5A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostname CVE-2026-09683.1A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' CVE-2026-09698.8The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of CVE-2026-09714.3An improper session timeout issue in Fortra's GoAnywhere MFT prior to version 7.10.0 results in SAML configured Web Users being redirected t