MEDIUM

CVE-2025-1250

Gitlab GitLab 2025-09-12 CVSS v3.1

CVSS

6.5

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user to stall background job processing by sending specially crafted commit messages, merge request descriptions, or notes.

Summary dbcve.org

An authenticated user can cause denial of service by submitting specially crafted commit messages, merge request descriptions, or notes that stall GitLab background job processing, affecting availability of automated workflows.

Mitigation

Upgrade GitLab to version 18.1.6, 18.2.6, 18.3.2 or later to patch the vulnerability.

Weakness (CWE)

CWE-770 Resource Allocation Without Limits

EPSS Score

0.45%

Probability of exploitation in next 30 days

38.8th percentile

References

https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/519335 Broken Link https://hackerone.com/reports/2903896 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE