The flaw lies in the way GitLab processes requests to its GraphQL API. The system accepts input specifying a quantity but does not adequately validate the value. When this quantity is used, it causes the server to perform operations that consume significant processing resources. Because no authentication is required to send these requests, an attacker can repeatedly send them, leading to a state in which the server cannot respond to legitimate traffic, effectively turning the service into a denial of service. The weakness is catalogued as CWE‑1284.

This issue affects GitLab Community and Enterprise Editions. All releases version 13.0 through 18.8.8, 18.9.0 through 18.9.4, and 18.10.0 through 18.10.2 are susceptible. Versions 18.8.9, 18.9.5, 18.10.3, and later releases are not affected.

The CVSS base score for the vulnerability is 7.5, indicating high severity. No EPSS data is presently available, and the defect is not yet listed in the CISA KEV catalog. Attackers can target the vulnerable systems by sending unverified GraphQL queries over the network, so authenticated access is not necessary. Because the flaw allows repeated requests to overload the server, the exploitation condition is readily met for reachable installations, making the risk significant for organizations still running the affected versions.