MEDIUM

CVE-2025-10094

Gitlab GitLab 2025-09-12 CVSS v3.1

CVSS

6.5

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to disrupt access to token listings and related administrative operations by creating tokens with excessively large names.

Summary dbcve.org

Authenticated GitLab users could create tokens with excessively large names, causing a denial of service on token listing pages and blocking administrative operations. This is an input validation vulnerability where the token name field lacks proper length constraints.

Mitigation

Upgrade GitLab to version 18.1.6, 18.2.6, 18.3.2 or later to implement token name length validation.

Weakness (CWE)

CWE-1284

EPSS Score

0.46%

Probability of exploitation in next 30 days

38.9th percentile

References

https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/528469 Broken Link https://hackerone.com/reports/3049089 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE