What is CVE-2026-112212?

CVE-2026-112212 is a high-severity vulnerability in GitLab, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 7.5/10. Published 2026-10-22.

How severe is CVE-2026-112212?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in GitLab

CVE-2026-112212

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.

Vulnerability class: HTTP Request Smuggling

Published 2026-10-22 · last modified 2026-10-22.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

GitLab

Weakness classification (CWE)

CWE-444 — Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling)

References

Frequently asked questions

What is CVE-2026-112212?: CVE-2026-112212 is a high-severity vulnerability in GitLab, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 7.5/10. Published 2026-10-22.
How severe is CVE-2026-112212?: High severity. CVSS v3 base score is 7.5 out of 10.