EUVD-2025-210778
GHSA-9wjm-8m84-7hcx
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Authenticated network access to the SCIM endpoint (AV:N, PR:L); unbounded loop causes availability loss only, with no confidentiality or integrity impact (A:H, C:N, I:N).
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
3DescriptionCVE.org
GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the SCIM user provisioning feature.
AnalysisAI
GitLab Enterprise Edition's SCIM user provisioning feature allows an authenticated low-privileged user to trigger an unbounded loop via specially crafted input, causing denial of service on the affected instance. Versions spanning a wide range from 11.10 through 19.3.0 are affected, with vendor-released patches now available. A publicly available exploit is documented in HackerOne report #3292470; however, this vulnerability is not listed in CISA KEV, indicating active exploitation has not been confirmed at scale.
Technical ContextAI
The vulnerability is rooted in CWE-835 (Loop with Unreachable Exit Condition), a class of flaw where attacker-controlled input can prevent a processing loop from ever reaching its termination condition, resulting in indefinite CPU or resource consumption. The affected subsystem is the SCIM (System for Cross-domain Identity Management) user provisioning feature, an enterprise-tier GitLab capability used to automate user lifecycle management via identity providers such as Okta or Azure Active Directory. The CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* covers all GitLab builds, though the vendor advisory scopes the flaw specifically to the EE edition where SCIM provisioning is available. The SCIM endpoint processes external identity provider payloads over the network, and failure to bound loop iterations on malformed input creates the exploitable condition.
RemediationAI
Upgrade GitLab EE to version 19.1.7, 19.2.5, or 19.3.1, which contain the vendor-released remediation as documented at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/. If immediate patching is not feasible, restrict network access to the SCIM provisioning API endpoint (typically under /api/scim/) to known identity provider source IP ranges only via firewall or reverse-proxy ACL rules; this reduces the attack surface to trusted infrastructure rather than all authenticated users. Note that this workaround does not eliminate the vulnerability - it reduces exposure - and will break SCIM provisioning if the identity provider IPs are not correctly enumerated. Disabling the SCIM feature entirely is the most effective interim mitigation but will halt automated user lifecycle management.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. Rated critical severity (CVSS 10
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.
The SSH key upload feature (lib/gitlab_keys.rb) in gitlab-shell before 1.7.3, as used in GitLab 5.0 before 5.4.1 and 6.x
A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. Rated critical severity (CVSS 9.8)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions star
When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab af
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7.9 before 13.8.7, all versions sta
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. Rated critical severity (CVSS 9.8), this vulnerability is
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today