How to fix CVE-2025-13929?

Within 24 hours: Identify all GitLab CE/EE instances and their versions in your environment; assess exposure by reviewing access logs for suspicious resource consumption patterns. Within 7 days: Implement network-level rate limiting and resource throttling policies; enable detailed monitoring of CPU, memory, and API request rates; consider restricting GitLab access to trusted networks if feasible. Within 30 days: Establish upgrade timeline to GitLab 18.7.7 or later once patches are available; test patched versions in non-production environment; execute phased deployment across production systems.

Is Gitlab affected by CVE-2025-13929?

GitLab instances running versions 10.0 through 18.7.6 are vulnerable to a resource exhaustion attack that could render the platform unavailable to users.

CVE-2025-13929

HIGH

2026-03-11 [email protected]

7.5

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 16:16 nvd

HIGH 7.5

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certain conditions.

Analysis

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 versions up to 18.7.6 is affected by allocation of resources without limits or throttling (CVSS 7.5).

Technical Context

This vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) affects GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certain conditions.

Affected Products

Product: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0. Versions: up to 18.7.6.

Remediation

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.0

CVSS: +38

POC: 0

CVE-2025-13929 vulnerability details – vuln.today

Back

CVE-2025-13929

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2025-13929

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code