GitLab has a vulnerability in its GraphQL interface that allows an unauthenticated user to trigger a denial of service by sending repeated queries. The flaw arises from improper validation of the quantity specified in input. The impact is that an attacker could exhaust server resources and degrade availability for all users. This issue is identified as CWE‑1284.

The affected product is GitLab Community Edition and Enterprise Edition. All releases from version 13.0 up to but not including 18.8.9, from 18.9.0 up to but not including 18.9.5, and from 18.10.0 up to but not including 18.10.3 are vulnerable. These include both the community and enterprise builds of GitLab.

The CVSS score is 7.5, indicating high severity. EPSS is less than 1%, suggesting low current exploitation probability, and it is not listed in the CISA KEV catalog. The vulnerability can be exploited by any remote user with network access to the GitLab instance, as authentication is not required. By repeatedly querying the GraphQL endpoint, an attacker can consume CPU and memory, leading to service interruption.