What is the CVSS score of CVE-2025-14870?

CVE-2025-14870 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of GitLab CE/EE are affected by CVE-2025-14870?

GitLab Community and Enterprise Editions (versions 18.5-18.11.2) contain a vulnerability allowing remote attackers without credentials to cause service unavailability through resource exhaustion.. A patch is available.

How to fix or mitigate CVE-2025-14870?

Within 24 hours: Audit all GitLab deployments to identify instances running versions 18.5-18.11.2. Within 7 days: Apply patch per GitLab security advisory to all affected systems. Within 30 days: Confirm patch deployment, verify affected versions are patched, and validate monitoring is detecting anomalous request patterns.

GitLab CE/EE CVE-2025-14870

EUVD-2025-209836 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-14 cve@gitlab.com

GHSA-97r5-5fr5-p642

Denial Of Service Gitlab

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:13 vuln.today

Patch available

May 14, 2026 - 07:01 EUVD

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted JSON payloads due to insufficient input validation.

AnalysisAI

Denial of service in GitLab Community and Enterprise Editions (versions 18.5 through 18.11.2) allows remote unauthenticated attackers to exhaust resources by submitting specially crafted JSON payloads that bypass input validation. The flaw is network-reachable with low complexity and no authentication required, but only impacts availability (CVSS 7.5, A:H). No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.04% (11th percentile), though CISA SSVC flags the issue as automatable.

Technical ContextAI

GitLab is a self-hostable DevOps platform built on Ruby on Rails that exposes numerous JSON-accepting API and web endpoints to unauthenticated traffic. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), meaning that the JSON parsing or downstream processing path does not enforce upper bounds on size, depth, or computational cost of incoming payloads. An attacker who supplies a crafted JSON document can therefore force the server to consume disproportionate CPU, memory, or worker threads, degrading service for legitimate users. The CPE data confirms both the Community (gitlab:community) and Enterprise (gitlab:enterprise) distributions are affected across the 18.5, 18.10, and 18.11 release branches.

RemediationAI

Vendor-released patch: upgrade self-managed GitLab CE/EE to 18.9.7, 18.10.6, or 18.11.3 depending on your current branch, as published in the GitLab patch release at https://about.gitlab.com/releases/2026/05/13/patch-release-gitlab-18-11-3-released/. For instances that cannot be patched immediately, place GitLab behind a reverse proxy or WAF that enforces strict request size limits and JSON body size/depth caps on API and web endpoints, and rate-limit unauthenticated requests at the network edge - note that aggressive size caps may break legitimate large API operations such as repository imports or bulk webhooks. Restricting unauthenticated access to the GitLab instance via IP allowlisting or VPN-only exposure also significantly reduces attack surface but breaks public sign-up and unauthenticated clone-over-HTTPS use cases.