CVE-2025-4225: Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 14.1 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that that under certain conditions could have allowed an unauthenticated attacker to cause a denial-of-service condition affecting all users by sending specially crafted GraphQL requests.
Other sources
GitLab has remediated an issue that under certain conditions could have allowed an unauthenticated attacker to cause a denial-of-service condition affecting all users by sending specially crafted GraphQL requests.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-4225?
CVE-2025-4225 has a severity that allows unauthenticated attackers to cause a denial-of-service condition.
How do I fix CVE-2025-4225?
To fix CVE-2025-4225, upgrade GitLab CE/EE to version 18.1.5 or newer, or 18.2.5 or newer, or 18.3.1 or newer.
Which versions are affected by CVE-2025-4225?
CVE-2025-4225 affects GitLab CE/EE versions from 14.1 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1.
Can CVE-2025-4225 be exploited remotely?
Yes, CVE-2025-4225 can be exploited by unauthenticated attackers remotely to cause a denial-of-service.
What type of vulnerability is CVE-2025-4225?
CVE-2025-4225 is classified as a denial-of-service vulnerability.