CVE-2025-3601: Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 8.15 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have could have allowed an authenticated user to cause a Denial of Service (DoS) condition by submitting URLs that generate excessively large responses.
Other sources
GitLab has remediated an issue that could have allowed an authenticated user to cause a Denial of Service (DoS) condition by submitting URLs that generate excessively large responses.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-3601?
CVE-2025-3601 is identified as a Denial of Service (DoS) vulnerability affecting multiple versions of GitLab CE/EE.
How do I fix CVE-2025-3601?
To fix CVE-2025-3601, upgrade to GitLab versions 18.1.5, 18.2.5, or 18.3.1 or later.
Which versions are affected by CVE-2025-3601?
CVE-2025-3601 affects all GitLab CE and EE versions from 8.15 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1.
Who can exploit CVE-2025-3601?
CVE-2025-3601 can be exploited by authenticated users who submit certain URLs that can cause a DoS condition.
What happens if I don't address CVE-2025-3601?
If CVE-2025-3601 is not addressed, it may lead to a Denial of Service, impacting the availability of your GitLab services.