We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-1388

CVE-2026-1388

Express

Severity: HIGH
CVSS: 7.5CVSS
Published: 2026-02-25
Last modified: 2026-02-28
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-1333

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause regular expression denial of service by sending specially crafted input to a merge request endpoint under certain conditions.

References

https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/
https://gitlab.com/gitlab-org/gitlab/-/issues/587560
https://hackerone.com/reports/3482893

Summary

Description

References