GitLab has an issue where resources are allocated without limits or throttling, leading to a denial of service when authenticated users trigger certain webhook response handling paths. This flaw, identified as CWE-770, allows a single user to compromise the availability of the GitLab instance by exhausting system resources during webhook processing.

Affected vendors and products include GitLab:GitLab. All versions from 9.3 up to, but not including, 18.7.6, from 18.8 up to 18.8.6, and from 18.9 up to 18.9.2 are vulnerable.

The CVSS score is 6.5, indicating a moderate severity. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog. The attack can be carried out by an authenticated user who can trigger a webhook response that forces the application to allocate excessive resources. Exploitation requires that the attacker can influence the webhook content and the conditions under which the vulnerable code path is executed.