CVE-2025-14871: Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.1.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.2.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 19.3.2
Event History
Frequently Asked Questions
Which GitLab releases need to be updated?
Affected versions are GitLab CE/EE from 18.4.6 up to, but excluding, 19.1.8; 19.2 up to, but excluding, 19.2.6; and 19.3 up to, but excluding, 19.3.2. Updating to 19.1.8, 19.2.6, 19.3.2, or a later applicable release remediates the issue.
Does exploitation require an authenticated GitLab account?
No. Under certain conditions, an unauthenticated user could trigger denial of service through improper resource-allocation limits in GraphQL complexity calculation logic.
What is the expected security impact?
The reported impact is denial of service. The supplied vector indicates network-reachable exploitation with low attack complexity, no privileges, and no user interaction; confidentiality and integrity impacts are listed as none.