CVE-2025-7449: Allocation of Resources Without Limits or Throttling in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user with specific permissions to cause a denial of service condition through HTTP response processing.
Other sources
GitLab has remediated an issue that could have allowed an authenticated user with specific permissions to cause a denial of service condition through HTTP response processing.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.4.5Fixed in 18.5.3Fixed in 18.6.1 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.4.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.5.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.6.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-7449?
CVE-2025-7449 has been assessed as a high severity vulnerability due to its potential to cause a denial of service condition.
How do I fix CVE-2025-7449?
To remediate CVE-2025-7449, upgrade GitLab to version 18.4.5, 18.5.3, or 18.6.1.
Who is affected by CVE-2025-7449?
CVE-2025-7449 affects all GitLab CE/EE versions from 8.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1.
What type of vulnerability is CVE-2025-7449?
CVE-2025-7449 is classified as a denial of service vulnerability that impacts HTTP response processing.
Can I mitigate CVE-2025-7449 without upgrading?
There are no known effective mitigations for CVE-2025-7449 other than upgrading to the fixed versions.