CVE-2025-8014

Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service disruption.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/556838	Broken Link
https://hackerone.com/reports/3228134	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:18.4.0::::community:::
	cpe:2.3:a:gitlab:gitlab:18.4.0::::enterprise:::

History

03 Oct 2025, 18:23

Type	Values Removed	Values Added
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/556838 -~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/556838 - Broken Link
References	~~() https://hackerone.com/reports/3228134 -~~	() https://hackerone.com/reports/3228134 - Permissions Required
First Time		Gitlab gitlab Gitlab
CPE		cpe:2.3:a:gitlab:gitlab:18.4.0::::enterprise::: cpe:2.3:a:gitlab:gitlab:::::enterprise:::* cpe:2.3:a:gitlab:gitlab:18.4.0::::community::: cpe:2.3:a:gitlab:gitlab:::::community:::*

27 Sep 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-09-27 17:15

Updated : 2025-10-03 18:23

NVD link : CVE-2025-8014

Mitre link : CVE-2025-8014

CVE.ORG link : CVE-2025-8014

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2025-8014", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2025-09-27T17:15:33.987", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/556838", "tags": ["Broken Link"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/3228134", "tags": ["Permissions Required"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service disruption."}], "lastModified": "2025-10-03T18:23:37.553", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "93BFA3A3-74FF-4A3C-A852-47222A68EEB4", "versionEndExcluding": "18.2.7", "versionStartIncluding": "11.10.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "318545D2-1C74-4698-8414-212C8D6BA4BF", "versionEndExcluding": "18.2.7", "versionStartIncluding": "11.10.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "75F843E1-B1EB-44F7-9966-9874F512A487", "versionEndExcluding": "18.3.3", "versionStartIncluding": "18.3.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "FEDB2960-F05D-4510-ACD3-05F16E621C6B", "versionEndExcluding": "18.3.3", "versionStartIncluding": "18.3.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:18.4.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "C0DA83D6-F16D-47B4-B817-1591FB60E5E6"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:18.4.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "6976AFEA-CD46-41A2-B52D-67FA8D4481D5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}