CVE-2026-7427

HighCVSS 7.5/10Last modified Aug 19, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Aug 12, 2026
Last modified
Aug 19, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-742707.8In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE aCVE-2026-74271In the Linux kernel, the following vulnerability has been resolved: power: supply: core: fix supplied_from allocations If dts property powCVE-2026-74272In the Linux kernel, the following vulnerability has been resolved: cxl/region: Resolve region deletion races Sungwoo noticed that the sysCVE-2026-74273In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the rangCVE-2026-74274In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fill first free targets[] slot during auto-discovery Any iCVE-2026-742758.4In the Linux kernel, the following vulnerability has been resolved: cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach() In cxCVE-2026-74276In the Linux kernel, the following vulnerability has been resolved: spi: xilinx: use FIFO occupancy register to determine buffer size The CVE-2026-742778.8In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA pathCVE-2026-74278In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix kernel heap address leak in bounce_error_event() The coCVE-2026-7427910.0In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sg_cleCVE-2026-74289.2Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with aCVE-2026-7428010.0In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The
CVE-2026-7427: High severity, CVSS 7.5 | Vulnix