GitLab confirmed a flaw that allows an authenticated user to trigger a denial of service by providing specially crafted webhook configuration inputs. The issue arises from improper validation of specified quantities in the input, causing the system to consume excessive resources when processing the request. The resulting denial of service could impact availability for the entire instance, potentially disrupting user access and service continuity.

The vulnerability affects GitLab Community Edition and GitLab Enterprise Edition in all releases from 16.10 up to, but not including, 18.8.7; from 18.9 up to, but not including, 18.9.3; and from 18.10 up to, but not including, 18.10.1. Users running any of these versions are considered impacted.

The CVSS score of 6.5 indicates a medium severity risk, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in CISA's KEV catalog. An attacker must first authenticate to the GitLab instance; once authenticated, they can submit a malicious webhook configuration that will drive the resource consumption leading to a denial of service. Mitigation through upgrading is the preferred solution.