CVE-2025-14870: Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted JSON payloads due to insufficient input validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.9.7 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.10.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.11.3
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14870?
CVE-2025-14870 has been classified as a denial of service vulnerability.
Which versions of GitLab are affected by CVE-2025-14870?
CVE-2025-14870 affects GitLab versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3.
How do I fix CVE-2025-14870?
To fix CVE-2025-14870, you should upgrade to GitLab version 18.9.7, 18.10.6, or 18.11.3 or later.
What does CVE-2025-14870 exploit?
CVE-2025-14870 exploits the allocation of resources without limits or throttling, potentially allowing denial of service.
Is CVE-2025-14870 an authenticated or unauthenticated vulnerability?
CVE-2025-14870 can be exploited by unauthenticated users.