An unauthenticated denial of service vulnerability in GitLab CE/EE, identified as CVE-2026-1662, poses a significant risk to service availability.

The vulnerability is a resource exhaustion flaw (CWE-770) located within the Jira events endpoint. It allows an unauthenticated attacker to trigger a denial of service state by sending specially crafted requests that bypass resource limits.

The ability for an unauthenticated remote attacker to crash the GitLab service can lead to significant operational downtime and disruption of CI/CD pipelines. With a CVSS score of 7.5, this high-severity vulnerability represents a substantial risk to business continuity, as it requires no user interaction or elevated privileges to execute.

Immediate Action: Upgrade all instances of GitLab CE/EE to version 18.7.5, 18.8.5, 18.9.1, or later versions to apply the necessary resource throttling patches.

Proactive Monitoring: Monitor server resource utilization, specifically memory and CPU spikes associated with the Jira integration endpoint, to identify potential exploitation attempts.

Compensating Controls: Implement rate limiting or WAF rules to drop suspicious or malformed requests directed at the Jira events API endpoint until the update can be applied.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical report on HackerOne.

Given the ease of exploitability and the potential for service disruption, organizations should prioritize patching their GitLab environments. Immediate deployment of the provided security updates is required to eliminate the threat of unauthorized denial of service attacks.