Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2025-8014: GitLab API can be flooded, causing service outage
CVE-2025-8014 · published 1 year ago
Summary
Some older GitLab versions let anyone send unlimited data‑request queries without the normal checks. This can consume the server’s processing power and memory, potentially making GitLab unavailable. Upgrade to the latest GitLab release (at least 18.2.7, 18.3.3 or 18.4.1) or apply the vendor’s patch, and consider restricting anonymous access to the API.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gitlab | gitlab |
>= 11.10.0, < 18.2.7 >= 18.3.0, < 18.3.3 18.4.0 cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* |
Original advisory text
Allocation of Resources Without Limits or Throttling in GitLab
Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service disruption.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8014.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-8014 Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/556838 Third Party Advisory
- https://hackerone.com/reports/3228134 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published27 Sep 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta