CVE-2025-1677: Allocation of Resources Without Limits or Throttling in GitLab
A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of service could occur upon injecting oversized payloads into CI pipeline exports.
Other sources
A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4. A denial of service could occur upon injecting oversized payloads into CI pipeline exports. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). It is now mitigated in the latest release and is assigned CVE-2025-1677.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-1677?
CVE-2025-1677 has a severity rating of Medium as it leads to a Denial of Service (DoS) affecting GitLab CE/EE.
How do I fix CVE-2025-1677?
To fix CVE-2025-1677, upgrade your GitLab CE/EE instance to version 17.9.6 or 17.10.4 or later.
What versions are affected by CVE-2025-1677?
CVE-2025-1677 affects GitLab CE/EE versions up to 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4.
What kind of attack does CVE-2025-1677 enable?
CVE-2025-1677 enables a Denial of Service (DoS) attack through the injection of oversized payloads into CI pipeline exports.
Is there any workaround for CVE-2025-1677?
Currently, there is no published workaround for CVE-2025-1677; updating to a fixed version is the recommended solution.