Introduction
Development teams that rely on GitLab for source code management and CI/CD could face total service disruption from a single network-based attack. CVE-2025-2256 lets any external actor make an affected GitLab instance unresponsive to all legitimate users by sending it multiple large SAML responses.
About GitLab: GitLab is a widely adopted DevSecOps platform with millions of users worldwide. Organizations of all sizes use it for source code management, CI/CD, and project collaboration. Both Community Edition (CE) and Enterprise Edition (EE) are used across industries, so vulnerabilities in GitLab have a high impact on the global technology ecosystem.
Technical Information
CVE-2025-2256 is a denial-of-service vulnerability in the SAML authentication flow of GitLab CE and EE. It comes from improper validation of the size and concurrency of SAML responses (CWE-1284: Improper Validation of Specified Quantity in Input).
Mechanism:
- An attacker sends multiple concurrent SAML authentication requests with excessively large SAML responses to the GitLab SAML endpoint.
- GitLab does not properly validate or limit the size and number of these incoming SAML responses.
- The authentication subsystem is overwhelmed and consumes excessive CPU and memory resources.
- The resulting resource exhaustion makes the instance unresponsive to all users.
Key technical points:
- Exploiting this issue requires no authentication.
- An attacker can launch the attack remotely against any GitLab instance that has SAML authentication enabled.
- The vulnerability affects both Community and Enterprise Editions.
- yuki_osaki discovered the issue and disclosed it responsibly through HackerOne.
Affected Systems and Versions
- GitLab Community Edition (CE) and Enterprise Edition (EE)
- All versions from 7.12 before 18.1.6
- 18.2 before 18.2.6
- 18.3 before 18.3.2
- Any deployment with SAML authentication enabled is vulnerable
Vendor Security History
GitLab has previously patched critical vulnerabilities in authentication, including SAML-related flaws (e.g., CVE-2024-45409, CVE-2025-25291, CVE-2025-25292). GitLab runs a monthly release cycle and a public bug bounty program, and it typically responds to critical vulnerabilities promptly, with coordinated advisories and patches across supported versions.
