HIGH

CVE-2025-10004

Gitlab GitLab 2025-10-09 CVSS v3.1

CVSS

7.5

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs.

Summary dbcve.org

GitLab contains a denial-of-service vulnerability where crafted GraphQL queries requesting large repository blobs can exhaust server resources, making the instance unresponsive or severely degraded.

Mitigation

Upgrade to GitLab versions 18.2.9, 18.3.5, 18.4.3 or later. If immediate upgrade is not possible, consider rate-limiting or temporarily disabling GraphQL API access.

Weakness (CWE)

CWE-770 Resource Allocation Without Limits

EPSS Score

0.53%

Probability of exploitation in next 30 days

43.9th percentile

References

https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/568121 Broken Link https://hackerone.com/reports/3026555 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE