The vulnerability is an improper input validation flaw in GitLab's protected branches API that allows an unauthenticated user to send specially crafted JSON payloads. If exploited, the attacker can cause a denial of service condition, preventing legitimate users from accessing the API or potentially exhausting system resources. This weakness aligns with CWE-1284, where validation errors lead to service disruption.

Affected systems are GitLab Community Edition and Enterprise Edition instances running any version from 16.11 up to, but not including, 18.7.6; 18.8 versions prior to 18.8.6; and 18.9 versions prior to 18.9.2. All GitLab official products, including community and enterprise editions, are impacted, as indicated by the provided CPE strings.

The CVSS score of 7.5 indicates a high severity. The EPSS score of less than 1% suggests that the exploit probability is currently low. The vulnerability is not listed in CISA's KEV catalog. Because the attack requires unauthenticated access and only leads to service interruption, the risk is primarily availability degradation rather than confidentiality or integrity compromise. Exploitation would involve sending a crafted JSON request to the protected branches API endpoint to trigger the denial of service.