Description
An issue has been discovered in GitLab CE/EE affecting all versions from 7.8 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user with Developer-level access to cause a persistent denial of service affecting all users on a GitLab instance by uploading large files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 7.8 – < 18.1.6, 18.2 – < 18.2.6, 18.3 – < 18.3.2 | 18.1.6 |
Advisories 2
- NCSC-2025-0288 Kwetsbaarheden verholpen in GitLab CE/EE NCSC-NL (Netherlands) · Sep 12, 2025
- WID-SEC-2025-2024 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 11, 2025
References
- https://about.gitlab.com/releases/2025/09/10/patch-release-gitlab-18-3-2-released/
- GitLab Issue #554062 issue-tracking permissions-required
- HackerOne Bug Bounty Report #3161756 technical-description exploit permissions-required