Loading vulnerability…
Denial of Service in GitLab CE/EE GraphQL introspection
CVE-2025-8099 is a denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition affecting all versions from 10.8 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4. Under certain conditions, the GraphQL interface, described as involving GraphQL introspection, can be abused by an unauthenticated remote attacker through repeated GraphQL queries. The issue is characterized by uncontrolled or excessive resource allocation during query handling, allowing repeated or complex requests to overwhelm the service and degrade availability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause denial of service against a GitLab instance by exhausting server resources or otherwise overwhelming the GraphQL service path, resulting in service disruption or crash and loss of availability for users of the affected GitLab CE/EE deployment. Available information indicates no direct confidentiality or integrity impact, but availability impact is high.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of the GraphQL endpoint where operationally feasible, apply rate limiting or request throttling in front of GitLab, and increase monitoring for repeated or unusually expensive GraphQL query patterns indicative of resource-exhaustion attempts. These measures are temporary and do not replace upgrading to a fixed version.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed version. The issue is remediated in 18.6.6 and later for the 18.6 release line, 18.7.4 and later for the 18.7 release line, and 18.8.4 and later for the 18.8 release line. Self-managed deployments should prioritize upgrading to a patched release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.