This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] GitLab CE/EE fixes 5 vulnerabilities
GitLab fixes 5 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) with versions 18.8.2, 18.7.2 and 18.6.4 [1].
An unauthenticated remote attacker can perform a DoS attack by sending specially crafted requests with malformed authentication data [1].
The vulnerability is present in products:
- GitLab Community Edition; >=11.9, <18.6.4, >=18.7, <18.7.2, >=18.8,<18.8.2
- GitLab Enterprise Edition; >=11.9, <18.6.4, >=18.7, <18.7.2, >=18.8,<18.8.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-13927 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
The vulnerability was publicly disclosed 21. 1. 2026.
An unauthenticated remote attacker can perform a DoS attack by exploiting incorrect authorization checks in API endpoints [1].
The vulnerability is present in products:
- GitLab Community Edition; >=17.7, <18.6.4; >=18.7, <18.7.2; >=18.8, <18.8.2
- GitLab Enterprise Edition; >=17.7, <18.6.4; >=18.7, <18.7.2; >=18.8, <18.8.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-13928 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 21. 1. 2026.
An unauthenticated remote attacker can bypass two-factor authentication by means of forged device responses and knowledge of the credential ID of the victim's login device [1].
The vulnerability is present in products:
- GitLab Community Edition; >=18.6, <18.6.4; >=18.7, <18.7.2; >=18.8, <18.8.2
- GitLab Enterprise Edition; >=18.6, <18.6.4; >=18.7, <18.7.2; >=18.8, <18.8.2
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2026-0723 at cve.org, NVD
- CWE-252: Unchecked Return Value at cwe.mitre.org
The vulnerability was publicly disclosed 21. 1. 2026.
An authenticated remote attacker can perform a DoS attack by configuring malformed Wiki documents that bypass cycle detection [1].
The vulnerability is present in products:
- GitLab Community Edition; >=17.1, <18.6.4; >=18.7, <18.7.2; >=18.8, <18.8.2
- GitLab Enterprise Edition; >=17.1, <18.6.4; >=18.7, <18.7.2; >=18.8, <18.8.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2025-13335 at cve.org, NVD
- CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') at cwe.mitre.org
The vulnerability was publicly disclosed 21. 1. 2026.
An unauthenticated remote attacker can perform a DoS attack by repeatedly sending malformed SSH authentication requests [1].
The vulnerability is present in products:
- GitLab Community Edition; >=12.3, <18.6.4; >=18.7, <18.7.2; >=18.8, <18.8.2
- GitLab Enterprise Edition; >=12.3, <18.6.4; >=18.7, <18.7.2; >=18.8, <18.8.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
More information:
- CVE-2026-1102 at cve.org, NVD
- CWE-400: Uncontrolled Resource Consumption at cwe.mitre.org
The vulnerability was publicly disclosed 21. 1. 2026.
By CESNET, z.s.p.o. Michaela Jarošová on 21. 1. 2026.