Loading vulnerability…
Infinite-loop denial of service in GitLab Wiki redirects
CVE-2025-13335 is an infinite-loop vulnerability in Wiki redirect handling in GitLab Community Edition and Enterprise Edition. Under certain circumstances, an authenticated user can configure malformed Wiki documents that bypass cycle detection and cause denial of service. Affected versions are 17.1 through versions before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause denial of service in the affected GitLab installation through an infinite loop in Wiki redirect handling. The extent and duration of the resulting service disruption are not specified.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict Wiki editing capabilities to the smallest practical set of trusted authenticated users and closely monitor for abnormal resource consumption or service instability associated with Wiki processing. Because exploitation requires authenticated access and malformed Wiki document configuration, reducing access to Wiki authoring lowers exposure, but upgrading to a fixed version is the definitive mitigation.
Patch, then assume compromise.
Upgrade affected GitLab CE/EE installations to 18.6.4, 18.7.2, or 18.8.2, or a later fixed version appropriate for the release branch. The updates include database migrations that may cause downtime on single-node installations; multi-node deployments can use GitLab's zero-downtime upgrade procedures. GitLab.com was already patched when the updates were announced, and GitLab Dedicated customers required no action.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.