High · published November 27, 2025
⚡ An unauthenticated user can crash your GitLab instance with a cleverly crafted JSON payload — that’s all it takes to trigger a Denial of Service! 🔥 Think of it like a restaurant that can’t handle a sudden influx of diners because someone keeps sending in fake reservations. The kitchen gets overwhelmed, and real customers are left waiting for their meals — or worse, turned away entirely! If exploited, this vulnerability could lead to your GitLab service becoming unresponsive, leaving users unable to access their repositories or manage their projects. It’s not just an inconvenience; it can halt productivity and frustrate your team as they struggle with service disruptions.
Think of it like a restaurant that can’t handle a sudden influx of diners because someone keeps sending in fake reservations. The kitchen gets overwhelmed, and real customers are left waiting for their meals — or worse, turned away entirely! This Denial of Service vulnerability exists in GitLab CE/EE versions prior to 18.4.5, 18.5.3, and 18.6.1, where attackers can send specially crafted requests with malicious JSON payloads to overwhelm the server.
If exploited, this vulnerability could lead to your GitLab service becoming unresponsive, leaving users unable to access their repositories or manage their projects. It’s not just an inconvenience; it can halt productivity and frustrate your team as they struggle with service disruptions. To protect your application, ensure you update GitLab CE/EE to version 18.4.5, 18.5.3, or 18.6.1 or later. Regularly monitor your systems for any unusual activity and update as needed to keep your services running smoothly. You've got this! Follow these steps, and you'll have your GitLab environment secure in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| gitlab/gitlab | ≥ 17.10.0, < 18.4.5 | 18.4.5 |
| gitlab/gitlab | ≥ 17.10.0, < 18.4.5 | 18.4.5 |
| gitlab/gitlab | ≥ 18.5.0, < 18.5.3 | 18.5.3 |
| gitlab/gitlab | ≥ 18.5.0, < 18.5.3 | 18.5.3 |
| gitlab/gitlab | all versions | — |
| gitlab/gitlab | all versions | — |