Executive brief
GitLab has addressed a security vulnerability that could allow an unauthorized person to crash or slow down the GitLab service. By sending a specifically formatted data request, an attacker can overwhelm the system's resources, making the platform unavailable to legitimate users. This affects organizations using GitLab for software development and version control, potentially halting production and developer workflows.
Technical details
A denial of service (DoS) vulnerability exists in GitLab CE/EE due to insufficient input validation when processing JSON payloads. The flaw is categorized as CWE-770 (Allocation of Resources Without Limits or Throttling), where the application fails to properly restrict the resources consumed by incoming requests. An unauthenticated remote attacker can exploit this by sending a specially crafted JSON payload over the network, leading to resource exhaustion and service unavailability. The issue affects versions 18.5 through 18.11.2 and has been patched in versions 18.9.7, 18.10.6, and 18.11.3.
Affected products
- GitLab GitLab Community Edition (CE) 18.5 to < 18.9.7, 18.10 to < 18.10.6, 18.11 to < 18.11.3
- GitLab GitLab Enterprise Edition (EE) 18.5 to < 18.9.7, 18.10 to < 18.10.6, 18.11 to < 18.11.3
Timeline
- 2026-05-13: patched: GitLab released versions 18.11.3, 18.10.6, and 18.9.7 to address the issue.
- 2026-05-14: disclosed: Public disclosure of CVE-2025-14870.