Loading vulnerability…
Unauthenticated denial of service in GitLab Releases API
CVE-2025-13928 is an incorrect authorization validation vulnerability in the Releases API of GitLab Community Edition and Enterprise Edition. An unauthenticated attacker can exploit authorization checks in API endpoints to cause a denial-of-service condition. Affected versions are 17.7 through versions before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disrupt GitLab availability through an unauthenticated denial-of-service condition. The precise scope, duration, and underlying resource or process failure are not specified.
If you can’t patch tonight, do this now.
Until the upgrade is applied, restrict access to GitLab API endpoints from untrusted networks using network ACLs, VPN access, or reverse-proxy allowlists, and limit unauthenticated access paths. These measures reduce exposure but do not correct the authorization flaw.
Patch, then assume compromise.
Upgrade affected GitLab CE/EE installations to 18.6.4, 18.7.2, or 18.8.2, as appropriate for the release branch, or a later fixed release. Self-managed deployments should upgrade immediately. These updates include database migrations that can cause downtime on single-node instances; multi-node deployments can use GitLab's zero-downtime upgrade procedures. GitLab.com was already patched at release time, and GitLab Dedicated customers required no action.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.