High · published October 27, 2025
⚡ An unauthenticated attacker can send a few crafty GraphQL requests to bring your GitLab instance to its knees. Just like a prank caller tying up the phone lines, this could lead to a denial of service! Think of it like a restaurant where an unwanted customer keeps placing orders for the entire menu, overwhelming the kitchen staff and causing a backlog. This flood of requests can paralyze your GitLab service just as efficiently! If an attacker successfully crafts these JSON payloads, they could make your GitLab service unavailable. This means users won't be able to access their repos, track issues, or collaborate effectively, leading to potentially significant downtime for your projects!
Think of it like a restaurant where an unwanted customer keeps placing orders for the entire menu, overwhelming the kitchen staff and causing a backlog. This flood of requests can paralyze your GitLab service just as efficiently! This vulnerability in GitLab CE/EE affects all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1, allowing unauthenticated attackers to exploit the service via specially crafted GraphQL requests, resulting in a denial of service condition.
If an attacker successfully crafts these JSON payloads, they could make your GitLab service unavailable. This means users won't be able to access their repos, track issues, or collaborate effectively, leading to potentially significant downtime for your projects! To protect your GitLab instance, update to version 18.3.5, 18.4.3, or 18.5.1 immediately. Make sure to monitor your logs for any suspicious activity related to GraphQL requests as you patch. Staying proactive is key! You've got this! By following these steps, you'll fortify your GitLab against potential attacks and keep collaborating smoothly! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| gitlab/gitlab | ≥ 11.0.0, < 18.3.5 | 18.3.5 |
| gitlab/gitlab | ≥ 11.0.0, < 18.3.5 | 18.3.5 |
| gitlab/gitlab | ≥ 18.4.0, < 18.4.3 | 18.4.3 |
| gitlab/gitlab | ≥ 18.4.0, < 18.4.3 | 18.4.3 |
| gitlab/gitlab | all versions | — |
| gitlab/gitlab | all versions | — |