EUVD-2025-208993
GHSA-3f68-rg4r-xc3q
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionNVD
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to cause a denial of service due to excessive resource consumption when handling certain CI-related inputs.
AnalysisAI
GitLab CE/EE contains a denial of service vulnerability in CI-related input handling that allows authenticated users to consume excessive server resources, potentially rendering the service unavailable. Versions 13.7 through 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 are affected across all GitLab installations. A publicly available proof-of-concept exists from HackerOne (report 3418149), though CISA has not flagged this for active exploitation in the wild, and the SSVC framework indicates no evidence of current weaponization despite automatable characteristics being unavailable.
Technical ContextAI
The vulnerability stems from CWE-770 (Allocation of Resources Without Limits or Throttling), a resource exhaustion weakness affecting GitLab's CI pipeline processing logic. The affected product is identified via CPE (cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*), indicating all GitLab installations regardless of deployment model are potentially vulnerable. The root cause lies in insufficient input validation and resource limits when processing certain CI configuration inputs, allowing an authenticated attacker to craft malicious CI job definitions or pipeline configurations that trigger unbounded resource allocation. This affects the GitLab CI/CD execution engine across multiple major version branches, suggesting the flaw exists in core pipeline parsing or scheduling logic rather than isolated feature components.
RemediationAI
Immediately upgrade to patched versions: GitLab 18.8.7 or later, GitLab 18.9.3 or later, or GitLab 18.10.1 or later depending on your current branch. Consult https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/ for exact upgrade procedures and release notes. As an interim control pending patching, implement CI job resource quotas at the runner and project level using GitLab's pipeline resource limits configuration to prevent unbounded resource consumption; restrict CI pipeline creation permissions to trusted users only; and monitor CI runner resource consumption for anomalous spikes that may indicate exploitation attempts. For organizations on unsupported version branches prior to 13.7, upgrade is mandatory as no patches are available.
More from same product – last 7 days
Command injection in Prefect 3.6.18's GitHub integration allows authenticated users to execute arbitrary git commands th
Incorrect authorization enforcement in GitLab CE/EE permits a blocked Project Access Token to continue reading private p
Identity confusion in GitLab EE's Duo AI workflow runners lets an authenticated, low-privileged user cause specific Duo
Denial of service in GitLab CE/EE affects all versions from 17.1 through those prior to 18.10.7, 18.11.4, and 19.0.1, al
Unauthorized private project enumeration in GitLab CE/EE exposes confidential project metadata to unauthenticated networ
Share
External POC / Exploit Code
Leaving vuln.today