Loading vulnerability…
Unauthenticated DoS in GitLab API endpoints
CVE-2025-14869 is an unauthenticated denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. The flaw is in GitLab's API layer and is caused by improper validation of specified input quantities on certain API endpoints. A remote attacker can send specially crafted payloads that trigger disproportionate resource consumption during request processing, leading to exhaustion of CPU, memory, or related system resources and impairing service availability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can degrade or disrupt the availability of an affected self-managed GitLab instance for legitimate users. The vulnerability is rated with high availability impact and does not require authentication or user interaction, making internet-facing deployments particularly exposed to service interruption.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of GitLab API endpoints to untrusted networks, restrict access through network controls or reverse-proxy filtering, and apply rate limiting or request-size controls where operationally feasible to reduce the likelihood of resource-exhaustion attacks. These measures are compensating controls and should not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade self-managed GitLab CE/EE installations to a fixed release: 18.9.7, 18.10.6, or 18.11.3 or later, depending on the deployed release track. GitLab SaaS is already patched and not affected.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.