Loading vulnerability…
Unauthenticated denial of service in GitLab Jira Connect integration
CVE-2025-13927 is a denial-of-service vulnerability in the Jira Connect integration of GitLab Community Edition and Enterprise Edition. An unauthenticated attacker can send crafted requests containing malformed authentication data to disrupt GitLab service. Affected versions are 11.9 through versions before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2. The underlying implementation defect and vulnerable function are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause a denial-of-service condition affecting GitLab availability. The extent and duration of disruption are not specified.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is documented. Interim exposure-reduction measures include restricting unauthenticated endpoint access through firewall or WAF controls, using VPN or SSO gateways, and applying rate limiting. These measures do not replace upgrading to a fixed release.
Patch, then assume compromise.
Upgrade affected GitLab CE/EE installations to 18.6.4, 18.7.2, or 18.8.2, as appropriate for the release branch, or a later fixed release. The updates include database migrations that may cause downtime on single-node deployments; multi-node deployments can use zero-downtime upgrade procedures.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.