MEDIUM

CVE-2025-3922

Gitlab GitLab 2026-04-22 CVSS v3.1

CVSS

6.5

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that could have allowed an authenticated user to cause denial of service by overwhelming system resources under certain conditions due to insufficient resource allocation limits in the GraphQL API.

Summary dbcve.org

An authenticated user can cause denial of service by overwhelming system resources through the GraphQL API due to insufficient resource allocation limits. This affects GitLab CE/EE versions 12.4 through 18.9.5, 18.10.0-18.10.3, and 18.11.0.

Mitigation

Upgrade GitLab to version 18.9.6, 18.10.4, 18.11.1 or later to patch the insufficient resource allocation limits in the GraphQL API.

Weakness (CWE)

CWE-770 Resource Allocation Without Limits

EPSS Score

0.4%

Probability of exploitation in next 30 days

34.2th percentile

References

https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab/-/work_items/537422 Broken Link https://hackerone.com/reports/3098035 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE