Loading vulnerability…
Denial of Service in GitLab GraphQL API
CVE-2025-12664 is a denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition affecting self-managed deployments. The flaw is caused by improper validation of the quantity of unauthenticated GraphQL requests, allowing repeated queries to overwhelm backend resources. It affects GitLab CE/EE versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3. The issue is distinct from single-request query complexity problems because exploitation relies on sustained request volume rather than the computational cost of one query. Existing request timeout and GraphQL complexity controls were insufficient to prevent the volumetric attack.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause severe service degradation or full denial of service on affected self-managed GitLab instances. Repeated unauthenticated GraphQL queries can consume CPU, memory, and backend worker capacity, increase latency for legitimate users, trigger request failures and timeout conditions, fill processing queues, and in extreme cases force the instance offline through resource exhaustion. The vulnerability affects availability and does not indicate direct confidentiality or integrity impact.
If you can’t patch tonight, do this now.
As a defense-in-depth measure, enable and tune user and IP-based rate limiting for exposed GitLab services, particularly where unauthenticated access to the GraphQL interface is permitted. Restrict unnecessary public exposure of self-managed GitLab instances where feasible. These measures may reduce exploitability but do not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade affected GitLab CE/EE installations to a fixed release. The vulnerability is remediated in GitLab 18.8.9, 18.9.5, and 18.10.3. Self-managed deployments running affected versions should be updated immediately to a supported patched version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.