GitLab’s repository archive endpoint processes specially crafted requests that can cause resource exhaustion, enabling an unauthenticated attacker to trigger a denial‑of‑service (DoS). The flaw stems from insufficient limits on resource allocation during archive generation, classified as CWE‑770. Once exploited, the affected system can become unresponsive, denying legitimate users access to the platform. The vulnerability affects all GitLab Community Edition (CE) and Enterprise Edition (EE) releases from v10.0 up to but excluding v18.7.6, v18.8.6, and v18.9.2, meaning that the majority of installations older than these patches are at risk.

All instances of GitLab CE and EE that have not applied the corrective upgrade are affected. Specifically, every released version between 10.0 and 18.9.1 is impacted. GitLab CE and EE deployments must evaluate whether they are running a vulnerable version and apply the patch accordingly.

The CVSS score of 7.5 indicates high severity, and while the EPSS score is below 1%, indicating a low current exploit probability, the lacking presence in the CISA KEV catalog does not preclude potential use by attackers. Because the bug can be triggered by unauthenticated web requests, it is remotely exploitable over the network. Successful exploitation results in service disruption, making this a high priority to remediate.