GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the SCIM user provisioning feature.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/ Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/571842 Issue Tracking, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · gitlabNVD modified 2026-10-19 22:10
Affected (CPE criteria) 2
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*cpe:2.3:a:gitlab:gitlab:19.3.0:*:*:*:enterprise:*:*:*
References 3
- https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/ Release Notes, Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/work_items/571842 Issue Tracking, Vendor Advisory
- https://hackerone.com/reports/3292470 Permissions Required, Third Party Advisory