CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2025-11447 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2025-11447
27 Oct 2025 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending GraphQL requests with crafted JSON payloads. • https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 1CVE-2025-10004 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2025-10004
09 Oct 2025 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs. • https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2025-2934 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2025-2934
09 Oct 2025 — GitLab has remediated an issue in GitLab CE/EE affecting all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2 that could have allowed an authenticated attacker to create a denial of service condition by configuring malicious webhook endpoints that send crafted HTTP responses. • https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2025-8014 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2025-8014
27 Sep 2025 — Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service disruption. • https://gitlab.com/gitlab-org/gitlab/-/issues/556838 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2025-10858 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2025-10858
26 Sep 2025 — An issue was discovered in GitLab CE/EE affecting all versions before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that allows unauthenticated users to cause a Denial of Service (DoS) condition while uploading specifically crafted large JSON files. • https://gitlab.com/gitlab-org/gitlab/-/issues/570034 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2025-2256 – Improper Validation of Specified Quantity in Input in GitLab
https://notcve.org/view.php?id=CVE-2025-2256
12 Sep 2025 — An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed unauthorized users to render the GitLab instance unresponsive to legitimate users by sending multiple concurrent large SAML responses. • https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released • CWE-1284: Improper Validation of Specified Quantity in Input •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1CVE-2025-7337 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2025-7337
12 Sep 2025 — An issue has been discovered in GitLab CE/EE affecting all versions from 7.8 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user with Developer-level access to cause a persistent denial of service affecting all users on a GitLab instance by uploading large files. • https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1CVE-2025-10094 – Improper Validation of Specified Quantity in Input in GitLab
https://notcve.org/view.php?id=CVE-2025-10094
12 Sep 2025 — An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to disrupt access to token listings and related administrative operations by creating tokens with excessively large names. • https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released • CWE-1284: Improper Validation of Specified Quantity in Input •
CVSS: 5.8EPSS: 0%CPEs: 6EXPL: 1CVE-2025-2246 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2025-2246
27 Aug 2025 — An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have allowed unauthenticated users to access sensitive manual CI/CD variables by querying the GraphQL API. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones anteriores a la 18.1.5, 18.2 anteriores a la 18.2.5 y 18.3 anteriores a la 18.3.1 que podría haber permitido a usuarios no autenticados acceder a variables manuales confidenciales de CI/CD ... • https://gitlab.com/gitlab-org/gitlab/-/issues/524592 • CWE-862: Missing Authorization •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 1CVE-2025-3601 – Allocation of Resources Without Limits or Throttling in GitLab
https://notcve.org/view.php?id=CVE-2025-3601
27 Aug 2025 — An issue has been discovered in GitLab CE/EE affecting all versions from 8.15 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have could have allowed an authenticated user to cause a Denial of Service (DoS) condition by submitting URLs that generate excessively large responses. Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 8.15 hasta la 18.1.5, la 18.2 hasta la 18.2.5 y la 18.3 hasta la 18.3.1 que podría haber permitido que un usuario autenticad... • https://gitlab.com/gitlab-org/gitlab/-/issues/536034 • CWE-770: Allocation of Resources Without Limits or Throttling •