EUVD-2025-209555
GHSA-4cg5-m8c9-x738
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
7DescriptionNVD
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service due to insufficient resource allocation limits when retrieving notes under certain conditions.
AnalysisAI
Denial of service in GitLab CE/EE affects authenticated users who can trigger resource exhaustion when retrieving notes under specific conditions, causing service unavailability. Versions 9.2 through 18.9.5, 18.10.0 through 18.10.3, and 18.11.0 are vulnerable. An authenticated attacker with standard user privileges can exploit this remotely without user interaction via crafted note retrieval requests. A publicly available exploit exists, and patches have been released by GitLab.
Technical ContextAI
The vulnerability stems from insufficient resource allocation limits (CWE-770) in GitLab's note retrieval functionality. When processing certain note requests, the application fails to properly constrain memory or CPU consumption, allowing an authenticated user to trigger unbounded resource allocation. This is a classic resource exhaustion attack vector affecting web application backends. The vulnerability requires authentication (PR:L in CVSS vector) but operates over the network with low attack complexity, suggesting the vulnerable code path is easily reachable and does not require special preconditions beyond basic user access.
RemediationAI
Upgrade immediately to GitLab 18.9.6, 18.10.4, or 18.11.1 or later, depending on your current version branch. For organizations unable to patch immediately, implement network-level rate limiting on authenticated API endpoints related to note retrieval (identify via GitLab API documentation), and restrict note retrieval endpoints to trusted internal networks only if the feature is not essential for external users. Monitor GitLab application logs and resource metrics for unusual CPU or memory spikes correlated with note retrieval API calls, which may indicate exploitation attempts. Note that these controls may impact legitimate note access patterns and should be tested in a staging environment before production deployment. See GitLab advisory at https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/ and the detailed issue at https://gitlab.com/gitlab-org/gitlab/-/work_items/548940 for additional context.
More from same product – last 7 days
Command injection in Prefect 3.6.18's GitHub integration allows authenticated users to execute arbitrary git commands th
Incorrect authorization enforcement in GitLab CE/EE permits a blocked Project Access Token to continue reading private p
Identity confusion in GitLab EE's Duo AI workflow runners lets an authenticated, low-privileged user cause specific Duo
Denial of service in GitLab CE/EE affects all versions from 17.1 through those prior to 18.10.7, 18.11.4, and 19.0.1, al
Unauthorized private project enumeration in GitLab CE/EE exposes confidential project metadata to unauthenticated networ
Share
External POC / Exploit Code
Leaving vuln.today