GitLab's Webhook custom header validation contains a flaw that allows an authenticated user to submit requests with specially crafted header names. The improper input handling can cause the system to allocate resources without applying limits or throttling, leading to a denial of service condition. This weakness is identified as CWE-770 and can disrupt service availability for the affected instance.

All GitLab Community Edition (CE) and Enterprise Edition (EE) deployments from version 16.11 up to but excluding 18.7.6, all 18.8 releases prior to 18.8.6, and all 18.9 releases prior to 18.9.2 are vulnerable. The vulnerability affects the GitLab product as a whole, irrespective of the community or enterprise distribution tags.

The CVSS profile scores the vulnerability a 6.5, which indicates moderate severity, and the EPSS score is below 1%, implying a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalogue. Exploitation requires authentication, so only users with valid credentials or compromised accounts can trigger the denial of service scenario. While the impact is limited to availability, the moderate severity and low exploitation probability reduce the urgency compared to higher-severity threats, but patching remains the recommended mitigation.