GitLab Releases Critical Security Patches to Address DoS and XSS Vulnerabilities

What happened

GitLab has rolled out critical security patches for its Community Edition (CE) and Enterprise Edition (EE) to remediate multiple high-severity vulnerabilities that could enable denial-of-service (DoS) conditions and cross-site scripting (XSS) attacks, among other risks.

Who is affected

Organizations using self-managed GitLab CE or EE instances on affected versions must apply the updates; hosted GitLab.com instances have already been patched. 

Why CISOs should care

The vulnerabilities include high-severity flaws, such as CVE-2025-7659, CVE-2025-8099, and CVE-2026-0958, that could allow attackers to crash services, exhaust server resources, inject malicious scripts, steal access tokens, or hijack user sessions. This poses significant threats to operational availability, data confidentiality, and the integrity of DevOps pipelines if left unmitigated. 

3 practical actions

1. Apply security patches immediately: Upgrade to the patched GitLab versions on all self-managed CE/EE deployments.
2. Audit exposed instances: Identify any remaining legacy GitLab installations and update them; ensure hosted and private instances align with security baselines.
3. Harden access and monitoring: Review API access logs for anomalous activity, enforce strong authentication controls, and implement WAF/IDS rules to detect attempted XSS or DoS exploitation.