Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 13.12 – < 18.2.8, 18.3 – < 18.3.4, 18.4 – < 18.4.2 | 18.2.8 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | gitlab | No fix yet | — |
Advisories 2
- WID-SEC-2025-2236 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 20, 2025
- NCSC-2025-0306 Kwetsbaarheden verholpen in GitLab NCSC-NL (Netherlands) · Oct 13, 2025
References
- https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/
- GitLab Issue #568121 issue-tracking permissions-required
- HackerOne Bug Bounty Report #3026555 technical-description exploit permissions-required