CVE-2026-15975 is a denial of service vulnerability in GitLab Community and Enterprise Editions. It affects all versions starting from 11.8 up to but not including 19.0.5, versions 19.1 up to but not including 19.1.3, and versions 19.2 up to but not including 19.2.1. Under certain conditions, an unauthenticated attacker could exploit insufficient resource throttling during the processing of merge request discussions to cause a denial of service. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).

An unauthenticated attacker can cause a denial of service condition in affected GitLab instances by exploiting insufficient resource throttling when handling merge request discussions. This does not impact confidentiality or integrity but results in service disruption (availability impact).

This vulnerability has been officially fixed by GitLab. Users should upgrade to versions 19.0.5 or later for the 11.8+ to 19.0.x range, 19.1.3 or later for the 19.1.x range, and 19.2.1 or later for the 19.2.x range. No additional mitigation is required once upgraded.