What is the CVSS score of EUVD-2025-18170?

EUVD-2025-18170 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Ubuntu are affected by EUVD-2025-18170?

Organizations using GitLab CE/EE affecting all should be aware of notable risk from CVE-2025-5996 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for EUVD-2025-18170?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18170. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2025-18170?

Within 30 days: Identify affected systems running GitLab CE/EE affecting all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Ubuntu EUVD-2025-18170

| CVE-2025-5996 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2025-06-12 cve@gitlab.com

Gitlab Denial Of Service Ubuntu Debian

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 21:20 euvd

EUVD-2025-18170

Analysis Generated

Mar 14, 2026 - 21:20 vuln.today

PoC Detected

Aug 08, 2025 - 18:20 vuln.today

Public exploit code

CVE Published

Jun 12, 2025 - 10:16 nvd

MEDIUM 6.5

DescriptionCVE.org

An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. A lack of input validation in HTTP responses could allow an authenticated user to cause denial of service.

Analysis

Technical ContextAI

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Allocation of Resources Without Limits or Throttling (CWE-770).

RemediationAI

Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.

More from same product – last 7 days

CVE-2026-8589 HIGH This Week POC

8.7 Jun 11

Stored cross-site scripting and account integrity abuse in GitLab Enterprise Edition versions 13.1.4 through 18.10.7, 18

CVE-2026-10087 HIGH This Week POC

8.7 Jun 11

Stored cross-site scripting in GitLab Enterprise Edition's Analytics Dashboard allows an authenticated developer-role us

CVE-2026-6552 HIGH This Week POC

8.7 Jun 11

Account takeover in GitLab Enterprise Edition versions 15.5 through 19.0.2 allows an authenticated group Owner to hijack

CVE-2026-7250 HIGH This Week POC

7.5 Jun 11

Denial of service in GitLab CE/EE versions 12.10 through 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 allows un

CVE-2026-1500 MEDIUM This Month POC

6.5 Jun 11

Uncontrolled resource consumption in GitLab CE/EE's file upload processing pipeline enables any authenticated user to tr

Vendor StatusVendor

Ubuntu

Priority: Medium

gitlab

Release	Status	Version
xenial	ignored	-
jammy	DNE	-
noble	DNE	-
oracular	DNE	-
plucky	DNE	-
upstream	needs-triage	-

Debian

gitlab

Release	Status	Fixed Version	Urgency
sid	vulnerable	17.6.5-19	-
(unstable)	fixed	(unfixed)	-

EUVD-2025-18170 vulnerability details – vuln.today

Back

Ubuntu EUVD-2025-18170

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More from same product – last 7 days

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code