GitLab CE/EE EUVD-2025-209551

Valid GitLab API authentication (session token, personal access token, or OAuth token) is required to access the GraphQL API endpoint. The vulnerability triggers when an authenticated user submits GraphQL queries without the API enforcing resource allocation limits-this is the default configuration in affected versions. No special GitLab feature flags, non-standard configuration, or privileged account role are required; any authenticated user (including read-only accounts) can exploit the vulnerability. Exploitation is NOT limited by user role, project membership, or admin privileges. The attack does not require user interaction beyond submitting the malicious query. The scope is unchanged (SU), meaning the attacker's own resources are consumed, but denial of service affects the shared GitLab instance and all its users.

CVSS 6.5 with AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates a network-accessible vulnerability with low attack complexity and high availability impact, but requiring authenticated access (PR:L). SSVC framework assessment rates Exploitation as 'poc' (publicly available code exists but not automated weaponization), Automatable as 'no' (human interaction required to craft effective payloads), and Technical Impact as 'partial' (denial of service only; no data exfiltration or integrity compromise). The requirement for valid authentication significantly reduces real-world attack surface compared to unauthenticated DoS vectors, as attackers must either compromise legitimate credentials or exploit accounts with API access. However, the low attack complexity and public exploit code mean that once an attacker gains authentication (e.g., via phished credentials, insider threat, or compromised API token), exploitation is straightforward and requires no special skill. Priority depends on credential hygiene: organizations with strong API key rotation, single-use tokens, and audit logging can detect abuse quickly; those with long-lived shared tokens or weak monitoring face greater risk. The partial technical impact (DoS only) suggests this is a legitimate but not critical priority compared to RCE or data exfiltration vulnerabilities.

An attacker with valid GitLab API credentials (obtained via credential compromise or social engineering) constructs a malicious GraphQL query with excessive nesting or expensive aggregations-for example, a query requesting deeply nested user, project, and issue relationships with no depth limit. The attacker submits the query via the GitLab GraphQL endpoint multiple times in rapid succession, forcing the server to allocate memory and CPU cycles without hitting resource limits. Within seconds to minutes, the GitLab instance consumes available memory or CPU, becoming unresponsive to legitimate users and API requests. Publicly available exploit code (documented in the HackerOne report) provides ready-made payloads, lowering the barrier to entry.