CVE-2026-112212

GitLab CE/EE versions 18.3 before 19.3.6 , 19.4 before 19.4.3 , and 19.5 before 19.5.1 are vulnerable to HTTP Request/Response Smuggling (CWE-444). An unauthenticated user can poison a shared cache's OAuth/OIDC discovery document because the software improperly trusts user-supplied values when co...