What is the CVSS score of CVE-2025-14869?

CVE-2025-14869 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of GitLab CE/EE are affected by CVE-2025-14869?

GitLab Community and Enterprise Edition versions 18.5 through 18.11.2 are vulnerable to unauthenticated denial-of-service attacks via malicious API payloads, creating direct risk to service…. A patch is available.

How to fix or mitigate CVE-2025-14869?

Within 24 hours: Identify all GitLab instances in production and confirm version numbers (check for 18.5-18.11.2 range). Within 7 days: Upgrade to patched versions-18.9.7, 18.10.6, or 18.11.3 depending on current version line. Within 30 days: Validate patch deployment via GitLab version check, review API access logs for exploitation attempts, and establish API endpoint monitoring for unusual request patterns.

GitLab CE/EE CVE-2025-14869

EUVD-2025-209835 HIGH

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-05-14 cve@gitlab.com

GHSA-9xp2-wmw3-fm7w

Denial Of Service Gitlab

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:13 vuln.today

Patch available

May 14, 2026 - 07:01 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted payloads on certain API endpoints.

AnalysisAI

Denial of service in GitLab Community and Enterprise Edition versions 18.5 through 18.11.2 allows unauthenticated remote attackers to disrupt service availability by sending specially crafted payloads to certain API endpoints. The flaw maps to CWE-1284 (improper validation of specified quantity in input) and has been patched in 18.9.7, 18.10.6, and 18.11.3. No public exploit identified at time of analysis and EPSS probability is very low (0.03%, 9th percentile), but the SSVC framework flags the attack as automatable with partial technical impact.

Technical ContextAI

GitLab CE/EE is a self-hosted DevOps platform exposing a large surface of REST and GraphQL API endpoints, many of which are reachable pre-authentication. CWE-1284 (Improper Validation of Specified Quantity in Input) typically arises when an endpoint accepts user-controlled size, count, depth, or pagination parameters without enforcing sane upper bounds, allowing an attacker to force the server into expensive operations (excessive memory allocation, runaway loops, or unbounded database queries) that exhaust CPU, memory, or worker capacity. The CPE strings confirm both the community and enterprise editions across the 18.5, 18.10, and 18.11 branches are affected, indicating the defective input-handling code is in shared core API logic rather than an edition-specific feature.

RemediationAI

Vendor-released patch: upgrade to GitLab 18.9.7, 18.10.6, or 18.11.3 depending on which release train is deployed, per the GitLab patch release notes at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. Until upgrading, place GitLab behind an authenticated reverse proxy or VPN so the API endpoints are not reachable by anonymous internet clients (trade-off: breaks public clone/CI integrations that rely on unauthenticated read access), and apply WAF rate limiting and request-size caps on the GitLab API path prefixes (trade-off: tuning required to avoid breaking legitimate large API responses or CI traffic). Consult the upstream issue at https://gitlab.com/gitlab-org/gitlab/-/work_items/584489 and the HackerOne report at https://hackerone.com/reports/3447146 for any additional vendor-provided mitigations once disclosure is complete.