CVE-2026-2845
📋 TL;DR
This vulnerability allows authenticated users to cause denial of service in GitLab by exploiting a Bitbucket Server import endpoint. Attackers can repeatedly send large responses to overwhelm system resources. All GitLab CE/EE instances running affected versions are vulnerable.
💻 Affected Systems
- GitLab Community Edition
- GitLab Enterprise Edition
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability for all GitLab users, potentially disrupting development workflows and CI/CD pipelines.
Likely Case
Degraded performance or temporary service interruptions affecting import functionality and potentially other GitLab services.
If Mitigated
Minimal impact with proper rate limiting, monitoring, and network controls in place.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.7.5, 18.8.5, or 18.9.1
Vendor Advisory: https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/
Restart Required: Yes
Instructions:
1. Backup GitLab instance. 2. Update to patched version using official GitLab update methods. 3. Restart GitLab services. 4. Verify update completed successfully.
🔧 Temporary Workarounds
Disable Bitbucket Server Import
linuxTemporarily disable the vulnerable import endpoint
gitlab-rails runner "ApplicationSetting.current.update!(import_sources: ApplicationSetting.current.import_sources - ['bitbucket'])"
Implement Rate Limiting
allAdd rate limiting to import endpoints
Configure rate limiting in GitLab's application settings or via reverse proxy
🧯 If You Can't Patch
- Implement strict access controls to limit who can use import functionality
- Monitor import endpoint traffic for abnormal patterns and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check GitLab version against affected ranges: 11.2-18.7.4, 18.8.0-18.8.4, or 18.9.0Check Version:
sudo gitlab-rake gitlab:env:info | grep 'Version:'Verify Fix Applied:
Confirm GitLab version is 18.7.5, 18.8.5, or 18.9.1 or higher📡 Detection & Monitoring
Log Indicators:
- High frequency of import requests from single users
- Large response sizes in import logs
- Error logs indicating resource exhaustion
Network Indicators:
- Unusual traffic patterns to /import/bitbucket_server endpoints
- Sustained high bandwidth usage from single IPs
SIEM Query:
source="gitlab" AND (import OR bitbucket) AND (size>100MB OR count>100)