Introduction
A remote attacker with no credentials can disrupt any internet-facing GitLab instance running an affected version, using an unauthenticated denial-of-service flaw in GitLab's API layer. The flaw is tracked as CVE-2025-14869 with a CVSS score of 7.5. It comes from improper validation of input quantities on certain API endpoints, which lets specially crafted payloads exhaust system resources and degrade availability for legitimate users.
Technical Information
The root cause of CVE-2025-14869 falls under CWE-1284: Improper Validation of Specified Quantity in Input. This weakness class covers cases where an application does not properly validate the size, count, or quantity of data in user input. In GitLab's case, certain API endpoints do not adequately limit the size or volume of incoming request payloads, so an attacker can submit inputs that consume disproportionate system resources.
The CVSS 3.1 vector string is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. It describes an attack that is network accessible, low in complexity, and needs no privileges or user interaction. The impact on availability is high, and there is no effect on confidentiality or integrity. That profile is what makes the vulnerability concerning, since any network-reachable GitLab instance with exposed API endpoints is a potential target and exploitation needs no credentials at all.
Attack Flow
From the available information, the exploitation path looks like this:
- An attacker identifies a GitLab instance with API endpoints accessible over the network.
- The attacker crafts a payload that exploits the missing input quantity validation on one or more of these endpoints.
- The attacker submits the payload to the target API endpoint without authenticating.
- GitLab processes the oversized or malformed input and consumes excessive CPU, memory, or other system resources.
- The resource exhaustion degrades or completely disrupts service availability for legitimate users.
The specific API endpoints affected and the exact structure of the malicious payloads have not been publicly disclosed. That is consistent with responsible disclosure practice, because publishing those details before widespread patching would make exploitation easier. The CWE classification does strongly suggest unbounded or insufficiently bounded numeric parameters (page sizes, batch counts, or similar quantity fields) that the application processes without adequate limits.
Affected Systems and Versions
The vulnerability affects three version tracks of both GitLab Community Edition (CE) and Enterprise Edition (EE):
| Product | Affected Version Range | Fixed Version |
|---|---|---|
| GitLab CE/EE | 18.5 through versions before 18.9.7 | 18.9.7 |
| GitLab CE/EE | 18.10 through versions before 18.10.6 | 18.10.6 |
| GitLab CE/EE | 18.11 through versions before 18.11.3 | 18.11.3 |
GitLab SaaS environments already run the patched version and are not affected. Treat any self-managed installation running a version in the affected ranges as vulnerable, especially if its API endpoints are reachable from untrusted networks.
Vendor Security History
GitLab has a well-established process for disclosing and fixing vulnerabilities, and it consistently ships patches for several supported version tracks at the same time. It also runs a public bug bounty program on HackerOne, where external security researchers report vulnerabilities before they can be exploited. A researcher using the handle a92847865 reported CVE-2025-14869 through that program. GitLab combines this outside research with its own internal security engineering to secure a platform that organizations of all sizes rely on for software development.
