CVE-2025-1478: Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A lack of input validation in Board Names could be used to trigger a denial of service.
Other sources
GitLab has remediated an issue that could have allowed a successful attacker to deny access to legitimate users of the targeted system by crafting Board Names with sufficiently large sizes.Impacted versions GitLab CE/EE: all versions from 8.13 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-1478?
CVE-2025-1478 is a potentially severe vulnerability due to its capability to trigger a denial of service.
How do I fix CVE-2025-1478?
To fix CVE-2025-1478, upgrade GitLab CE/EE to version 17.10.7, 17.11.3, or 18.0.1 or higher.
Which versions are affected by CVE-2025-1478?
CVE-2025-1478 affects GitLab CE/EE versions from 8.13 to below 17.10.7, 17.11 to below 17.11.3, and 18.0 to below 18.0.1.
What type of issue is described in CVE-2025-1478?
CVE-2025-1478 describes a lack of input validation in Board Names that can lead to a denial of service.
Can CVE-2025-1478 affect my GitLab instance?
Yes, if you are using any affected versions of GitLab CE or EE, your instance is at risk of CVE-2025-1478.