The flaw allows an authenticated user to send specially crafted requests to GitLab’s discussions endpoint, causing the server to allocate resources without limits or throttling. This can deplete memory, CPU, or other critical resources, leading to a denial of service. The vulnerability is identified as CWE-770, reflecting a lack of resource management controls.

GitLab Community Edition and Enterprise Edition are affected. All versions from 10.6 up to 18.9.5, 18.10 up to 18.10.3, and 18.11 up to 18.11.0 can be impacted. The vendor’s advisory lists GitLab as the sole affected product.

The CVSS score of 6.5 indicates a moderate severity. EPSS data is not available, so the likelihood of exploitation presently cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires authenticated access to the application and crafted HTTP requests directed at the discussions endpoint; thus, it is a post-authentication, internal‑side vulnerability that can surface if an account with sufficient privileges can be used.