GitLab
GitLab Patch Release: 18.9.1, 18.8.5, 18.7.5
patch-release-gitlab-18-9-1-released Feb 25, 2026 Source: Vendor
Imported by the GitLab patch release catcher from https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-9-1-released/. 9 CVE sections listed. Draft. Review before publishing.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-9-1-released/
Are you credited here?
Sign in and claim your line: it is yours immediately, no review queue.
The name the vendor printed stays next to your handle for anyone to check against the advisory above,
and any member who thinks a claim is wrong can refute it.
Credited
8 lines
Showing 1–8 of 8
CVE-2026-0752
BR2026-0000-009259
unclaimed
Cross-site Scripting issue in Mermaid sandbox impacts GitLab CE/EE
Credited as aphantom
CVE-2025-14511
BR2026-0000-009260
unclaimed
Denial of Service issue in container registry impacts GitLab CE/EE
Credited as a92847865
CVE-2026-1662
BR2026-0000-009261
unclaimed
Denial of Service issue in Jira events endpoint impacts GitLab CE/EE
Credited as a92847865
CVE-2026-1388
BR2026-0000-009262
unclaimed
Regular Expression Denial of Service issue in GitLab merge requests impacts GitLab CE/EE
Credited as sim4n6
CVE-2025-3525
BR2026-0000-009263
unclaimed
Denial of Service issue in CI trigger API impacts GitLab CE/EE
Credited as pwnie
CVE-2026-1725
BR2026-0000-009264
unclaimed
Denial of Service issue in token decoder impacts GitLab CE/EE
Credited as vinax
CVE-2026-1747
BR2026-0000-009265
unclaimed
Improper Access Control issue in Conan package registry impacts GitLab EE
Credited as modhanami
CVE-2025-14103
BR2026-0000-009266
unclaimed
Access Control issue in CI job mutation impacts GitLab CE/EE
Credited as go7f0