CVE-2026-15975

CVE-2026-15975 is filed as a CVSS 7.5 DoS in GitLab's merge request discussion processing, but the severity score obscures two factors that should reshape your risk assessment: the unauthenticated attack vector and the seven-year version window this flaw persisted undetected. The critical detail is that merge request discussion processing runs server-side as a passive rendering function. An attacker does not need a legitimate GitLab account or any prior interaction with your instance. They send malformed discussion processing requests directly to the endpoint, and the system attempts to render them without adequate resource bounds. This is an insufficient resource throttling vulnerability (CWE-400) in a code path that likely assumed authenticated principals would always precede it—classic implicit trust that cascaded when the endpoint was exposed to unauthenticated callers. The seven-year affected version range (11.8 through 19.2.1) is the more alarming signal than CVSS 7.5. This wasn't a one-off coding error; it's an architectural assumption baked into discussion rendering that survived multiple security review cycles and GitLab architectural transitions. Expect the patch to be surgical—hardening the specific trigger condition rather than refactoring the resource model. Verify that legitimate discussion-heavy workflows (long threads, bulk imports, CI integrations) are not functionally broken by the patch, as this is where operational friction incentivizes weakening or delaying remediation. If your GitLab instance is internet-facing with unauthenticated access to merge request endpoints, treat this as a higher-priority remediation than the CVSS suggests. The exploit requires no authentication, no crafted payloads, and produces no distinctive signature—making it a poor match for IDS/IPS detection and a realistic candidate for practical DoS even with GitLab.com's EPSS score at 0.00394. Also consider the organizational blast radius: GitLab is your deployment pipeline, your secret manager, your CI/CD security gate. A GitLab DoS doesn't mean slow merge requests—it means frozen production deployments, dark security scanning, and a coordination hub gone silent exactly when incident response requires it. Prioritize accordingly.

Reviewed through automated stages and approved by a human before publication.