Loading vulnerability…
Unauthenticated DoS in GitLab Duo Workflows API
CVE-2025-14870 is an unauthenticated denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition affecting the Duo Workflows API. The flaw affects versions from 18.5.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. The issue is caused by insufficient input validation and missing bounds on resource consumption when processing specially crafted JSON payloads. An attacker can submit malformed or oversized JSON data to the unauthenticated API endpoint, causing excessive memory or CPU consumption and destabilizing the instance.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause significant service degradation or a complete denial of service on vulnerable self-managed GitLab instances. By exhausting server resources through crafted requests, an attacker can disrupt availability of GitLab services, including workflow-related operations, and potentially affect broader platform functionality until the instance is restarted or the load subsides. The vulnerability affects availability only; no direct impact to confidentiality or integrity has been established in the available information.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of the affected unauthenticated API surface by restricting network access to GitLab, placing the instance behind filtering or rate-limiting controls, and monitoring for abnormal request volume targeting workflow-related API functionality. Resource-limiting and reverse-proxy protections may reduce exploitability, but they do not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. The vulnerability is remediated in versions 18.9.7, 18.10.6, and 18.11.3. The vendor fix introduces proper input validation, bounds checking, and resource-consumption limits for the Duo Workflows API. Self-managed deployments running affected versions should be updated immediately to the appropriate patched version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.