What is the CVSS score of EUVD-2025-210916?

EUVD-2025-210916 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Which versions of GitLab are affected by EUVD-2025-210916?

GitLab Community and Enterprise Edition instances in the 18.4.6-19.1.7, 19.2.0-19.2.5, and 19.3.0-19.3.1 ranges that expose the GraphQL API to the internet or an internal network can be knocked…. A patch is available.

Is there a public PoC exploit available for EUVD-2025-210916?

Yes, a public proof-of-concept exploit is available for EUVD-2025-210916. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate EUVD-2025-210916?

Within 24 hours, inventory every GitLab deployment and confirm which ones fall in the affected ranges (18.4.6 through 19.1.7, 19.2.0 through 19.2.5, and 19.3.0 through 19.3.1) and expose the GraphQL API to the internet or a broadly reachable network segment; for any such instance, restrict GraphQL endpoint access at the reverse proxy, load balancer, or WAF to known trusted sources and enable alerting on abnormal request volume or latency. Within 7 days, disable the GraphQL API entirely on instances where it is not operationally required, apply rate limiting and query-depth/complexity caps at the edge, segment exposed GitLab services behind VPN or zero-trust access, and confirm monitoring and log capture for the affected endpoints; engage GitLab support for pre-release guidance if a fix is pending. Within 30 days, track the vendor advisory continuously and, as soon as a vendor-released patch or fixed version is published, upgrade every affected instance to the version specified in that advisory, then validate the fix in staging before production rollout, re-test any edge mitigations, and document the residual exposure and remediation timeline for management review.

GitLab EUVD-2025-210916

| CVE-2025-14871 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-09-16 GitLab

GHSA-22cc-9j92-vx92

Denial Of Service Gitlab

7.5

CVSS 3.1 · Vendor: GitLab

Severity by source

Vendor (GitLab) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network-accessible GraphQL endpoint with no user interaction; only availability is impacted, so C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Sep 16, 2026 - 07:01 EUVD

Analysis Generated

Sep 16, 2026 - 07:01 vuln.today

CVE Published

Sep 16, 2026 - 06:34 cve.org

HIGH 7.5

DescriptionCVE.org

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

AnalysisAI

Unauthenticated denial of service in GitLab CE/EE caused by flawed resource accounting in the GraphQL complexity calculation logic, allowing a crafted query to consume disproportionate server resources. Exploitation affects GitLab 18.4.6 through 19.1.7, 19.2.0 through 19.2.5, and 19.3.0 through 19.3.1 - any Internet- or network-reachable instance with the GraphQL API enabled. Public exploit code exists (a HackerOne report is cited as the source), but there is no CISA KEV listing confirming active in-the-wild exploitation at time of analysis.

Technical ContextAI

GitLab exposes a GraphQL API (built on the graphql-ruby library) at /api/graphql, which is enabled by default on GitLab CE and EE instances. To defend against abusive queries, GitLab applies a query complexity analyzer that scores a query before execution and rejects it if the score exceeds a configured maximum. CWE-770 (Allocation of Resources Without Limits or Throttling) describes the root cause precisely: the complexity calculation logic mis-scores certain query shapes - such as deeply nested fields or recursive fragment structures - so expensive queries pass the gate and are executed. Because the underlying Ruby/Puma worker processes are single-threaded and resource-bounded, a small number of these under-counted queries can saturate workers and exhaust memory, degrading or halting the GitLab instance. The CPE string cpe:2.3:a:gitlab:gitlab confirms the affected package is the core GitLab application itself, covering both Community and Enterprise editions.

RemediationAI

Vendor-released patches are available: upgrade to GitLab 19.3.2, 19.2.6, or 19.1.8 (or later in each maintained series) as documented at https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/; follow GitLab's standard upgrade path rather than skipping minor versions to avoid migration failures. If immediate upgrade is not possible, compensating controls include placing GitLab behind a reverse proxy or WAF and applying per-IP rate limiting on /api/graphql - trade-off: aggressive limits can throttle legitimate API clients, CI runners, and integrations. Blocking or disabling the GraphQL API entirely eliminates the attack surface but breaks features that depend on it (e.g., certain frontend interactions, some integrations and third-party tooling). Restricting network access to the GitLab web interface to trusted networks or VPN reduces exposure but is ineffective against internal or authenticated-network attackers. As defense in depth, enable GitLab's built-in Rack Attack / rate-limiting settings and monitor for worker saturation on Puma.