CVE-2025-3525: Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have, under certain circumstances, allowed an authenticated user with certain access to cause Denial of Service by creating specially crafted CI triggers via the API.
Other sources
GitLab has remediated an issue that could have, under certain circumstances, allowed an authenticated user with certain access to cause denial of service by creating specially crafted CI triggers via the API.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-3525?
CVE-2025-3525 is classified as a Denial of Service vulnerability affecting GitLab users.
How do I fix CVE-2025-3525?
To remediate CVE-2025-3525, upgrade to GitLab versions 18.7.5, 18.8.5, or 18.9.1.
Which versions of GitLab are affected by CVE-2025-3525?
CVE-2025-3525 affects GitLab versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1.
Is CVE-2025-3525 remote code execution vulnerability?
No, CVE-2025-3525 is specifically a Denial of Service vulnerability, not a remote code execution vulnerability.
Who is vulnerable to CVE-2025-3525?
Authenticated users with certain access levels in GitLab instances are potentially vulnerable to CVE-2025-3525.