CVE-2025-12562
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an unauthenticated user to create a denial of service condition by sending crafted GraphQL queries that bypass query complexity limits.
Summary dbcve.org
GitLab CE/EE contains a vulnerability where unauthenticated users can bypass GraphQL query complexity limits by sending specially crafted queries, potentially causing a denial of service condition. The vulnerability affects versions from 11.10 through 18.4.5, 18.5.x before 18.5.4, and 18.6.x before 18.6.2.
Mitigation
Upgrade GitLab to version 18.4.6, 18.5.4, or 18.6.2 or later to apply the vendor patch. Consider implementing additional GraphQL query rate limiting at the infrastructure level as a defense-in-depth measure.