CVE-2025-4097
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to cause a denial of service condition by uploading specially crafted images.
Summary dbcve.org
An authenticated user could upload specially crafted images to GitLab CE/EE that trigger a denial of service condition. The vulnerability stems from insufficient validation or resource limits during image processing, likely causing excessive memory consumption or processing loop when the malicious image is processed by the server.
Mitigation
Update GitLab to version 18.4.6, 18.5.4, 18.6.2 or later. If immediate patching is not possible, consider restricting or validating image uploads from untrusted users as a temporary workaround.