EUVD-2025-209549
GHSA-vhmr-xxmg-qhfg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
7DescriptionCVE.org
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service under certain conditions by exhausting server resources by making crafted requests to a discussions endpoint.
AnalysisAI
Authenticated users can trigger denial of service in GitLab CE/EE versions 10.6 through 18.11.0 by sending crafted requests to the discussions endpoint that exhaust server resources. The vulnerability requires valid authentication credentials and affects all affected versions across the 10.6, 18.9, 18.10, and 18.11 release branches. Publicly available exploit code exists; CISA has not yet listed this in the Known Exploited Vulnerabilities catalog, but active exploitation likelihood is moderate given public POC availability and the low complexity of resource exhaustion attacks.
Technical ContextAI
The vulnerability resides in GitLab's discussions endpoint (API or web interface handler) and involves improper resource consumption controls, classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The affected product is GitLab Community Edition and Enterprise Edition, a DevOps platform written primarily in Ruby on Rails. The issue stems from insufficient request validation or rate-limiting on the discussions endpoint, allowing authenticated attackers to craft requests that consume excessive CPU, memory, or database resources without triggering protection mechanisms. This is a classic resource exhaustion vector where the endpoint fails to implement per-user or per-request quotas on computationally expensive operations.
RemediationAI
Upgrade immediately to GitLab 18.9.6, 18.10.4, or 18.11.1 depending on the current release branch. For users unable to patch immediately, implement network-level rate-limiting on the discussions endpoint using a reverse proxy (nginx, HAProxy) or GitLab's built-in API rate-limiting features, restricting requests per authenticated user per minute to values appropriate for legitimate discussion activity (e.g., 60-100 requests/minute/user). Monitor CPU and memory utilization on application servers, and consider enabling per-endpoint request timeouts to prevent long-running queries from exhausting resources. Additionally, review GitLab access controls to ensure that external collaborators and service accounts have appropriate permission scopes, reducing the number of authenticated users capable of triggering the endpoint. The patch is confirmed available per vendor advisory (https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/). Side effects of aggressive rate-limiting are rare for discussions workflows, but test in a staging environment to confirm legitimate users are not impacted by the chosen thresholds.
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. Rated critical severity (CVSS 9.8), this vulnerability is
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today