CVE-2025-1516: Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper input validation in Tokens Names could be used to trigger a denial of service.
Other sources
GitLab has remediated an issue that could have allowed a successful attacker to deny access to legitimate users of the targeted system by generating tokens with sufficiently large names. Impacted versions GitLab CE/EE: all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-1516?
CVE-2025-1516 has a severity rating that indicates a potential denial of service due to improper input validation.
How do I fix CVE-2025-1516?
To fix CVE-2025-1516, upgrade GitLab CE/EE to version 17.10.8, 17.11.4, or 18.0.2 or later.
Which versions of GitLab are affected by CVE-2025-1516?
CVE-2025-1516 affects all versions of GitLab CE/EE from 8.7 to before 17.10.8, from 17.11 to before 17.11.4, and from 18.0 to before 18.0.2.
What type of vulnerability is CVE-2025-1516?
CVE-2025-1516 is classified as an input validation vulnerability that can lead to a denial of service.
What can happen if CVE-2025-1516 is exploited?
Exploitation of CVE-2025-1516 could allow an attacker to trigger a denial-of-service condition in GitLab.