High · published December 11, 2025
⚡ An unauthenticated user can trigger a denial of service in GitLab just by sending specially crafted GraphQL queries! 🔥 Think of it like a restaurant where anyone can walk in and keep ordering complicated dishes without limits, causing the kitchen to get overwhelmed and the service to grind to a halt. That's what this vulnerability does to your GitLab instance! If exploited, an attacker could flood the system with requests, essentially crashing it and making it unavailable to legitimate users. This could lead to significant downtime and disrupt operations, leaving teams in a tough spot!
Think of it like a restaurant where anyone can walk in and keep ordering complicated dishes without limits, causing the kitchen to get overwhelmed and the service to grind to a halt. That's what this vulnerability does to your GitLab instance! This vulnerability allows unauthenticated users to bypass query complexity limits in GraphQL, enabling potential denial of service attacks. Specifically, it affects GitLab CE/EE versions up to 18.4.6, 18.5.4, and 18.6.2.
If exploited, an attacker could flood the system with requests, essentially crashing it and making it unavailable to legitimate users. This could lead to significant downtime and disrupt operations, leaving teams in a tough spot! To remediate this issue, upgrade your GitLab CE/EE to the latest version (18.4.6, 18.5.4, or 18.6.2) as soon as possible. It's also a good idea to review your system for any unusual query activities and tighten access controls to minimize exposure. You've got this! Follow these steps, and you'll ensure your GitLab is secure and running smoothly! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| gitlab/gitlab | ≥ 11.10.0, < 18.4.6 | 18.4.6 |
| gitlab/gitlab | ≥ 11.10.0, < 18.4.6 | 18.4.6 |
| gitlab/gitlab | ≥ 18.5.0, < 18.5.4 | 18.5.4 |
| gitlab/gitlab | ≥ 18.5.0, < 18.5.4 | 18.5.4 |
| gitlab/gitlab | ≥ 18.6.0, < 18.6.2 | 18.6.2 |
| gitlab/gitlab | ≥ 18.6.0, < 18.6.2 | 18.6.2 |