MEDIUM

CVE-2025-11974

Gitlab GitLab 2025-10-27 CVSS v3.1

CVSS

6.5

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints.

Summary dbcve.org

GitLab CE/EE contains a denial of service vulnerability affecting versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1. Unauthenticated attackers can exploit specific API endpoints by uploading large files, causing resource exhaustion and service disruption.

Mitigation

Upgrade GitLab to version 18.3.5, 18.4.3, 18.5.1 or later. Consider rate limiting or blocking unauthenticated file upload API endpoints as a temporary measure while planning the upgrade.

Weakness (CWE)

CWE-770 Resource Allocation Without Limits

EPSS Score

0.36%

Probability of exploitation in next 30 days

29.7th percentile

References

https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/571761 Broken Link

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE