Allocation of Resources Without Limits or Throttling in GitLab (GitLab GitLab)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.59 % · percentile 48 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitLab
- NVD status
- Analyzed
Description
Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service disruption.
Weaknesses (CWE)
- CWE-770 — Allocation of Resources Without Limits or Throttling
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | GitLab |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · cve@gitlab.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-31430
- GCVE · GCVE-0-2025-8014
CERT-FR advisories
- CERTFR-2025-AVI-0820 — Multiples vulnérabilités dans GitLab · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*≥ 11.10.0 < 18.2.7cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*≥ 11.10.0 < 18.2.7cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*≥ 18.3.0 < 18.3.3cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*≥ 18.3.0 < 18.3.3cpe:2.3:a:gitlab:gitlab:18.4.0:*:*:*:community:*:*:*cpe:2.3:a:gitlab:gitlab:18.4.0:*:*:*:enterprise:*:*:*
Affected products
| Product | Versions |
|---|---|
| GitLab · GitLab | affected 11.10 < 18.2.7 ; affected 18.3 < 18.3.3 ; affected 18.4 < 18.4.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |