Skip to content
NewA calmer, faster ZeroHour
Vulnerability1 · 1 read

CVE-2025-14871

Unauthenticated Denial of Service in GitLab CE/EE via GraphQL Complexity Flaw

CVSS 3.1
7.5 high
EPSS
—
Published
·
Modified
Analyze CVE-2025-14871 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

CVE-2025-14871 is a denial-of-service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) caused by improper resource allocation limits (CWE-770) in the GraphQL complexity calculation logic. An unauthenticated remote attacker can trigger it by sending specially crafted queries to the GitLab GraphQL API, causing excessive resource consumption on the instance. The attacker gains high-impact disruption of service (CVSS availability impact: High), with no confidentiality or confidentiality/integrity impact per the CVSS vector. All self-managed GitLab CE/EE deployments running the affected version ranges are affected, and exploitation status is currently unknown with no public proof-of-concept and no listing in CISA KEV.

What to do: Upgrade self-managed GitLab CE/EE to the patched release for your version train: 19.1.8, 19.2.6, or 19.3.2. As an interim mitigation, restrict unauthenticated access to the GraphQL API endpoint (/api/graphql) from untrusted networks using firewall rules, allowlisting, or reverse-proxy rate limiting. Administrators should also review the related GitLab advisories referenced in recent headlines covering additional critical GitLab flaws and patch comprehensively.

ProductAffected
GitLab Community Edition (CE)all versions from 18.4.6 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2
GitLab Enterprise Edition (EE)all versions from 18.4.6 before 19.1.8; 19.2 before 19.2.6; 19.3 before 19.3.2
Estimated exposure
masshundreds of thousands of GitLab CE/EE instances (tens of millions of users), including tens of thousands of internet-exposed self-managed servers — GitLab CE/EE is one of the most widely deployed self-hosted DevOps platforms (GitLab reports tens of millions of registered users), and public internet scans have historically shown tens of thousands of exposed GitLab servers, any of which…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

Vendors
gitlab
Products
gitlab
Weakness
CWE-770
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story