GitLab’s GraphQL complexity calculation logic lacks limits on resource allocation, allowing an unauthenticated user to send crafted requests that trigger excessive memory or CPU usage, which can bring a GitLab instance to a denial of service. The flaw is associated with CWE-770. An attacker could cause the service to become unresponsive for legitimate users.

All GitLab Community Edition and Enterprise Edition releases from version 18.4.6, inclusive, up to but not including the patched releases 19.1.8, 19.2.6, and 19.3.2 are affected. The recommended fix is to upgrade to any GitLab build 19.1.8, 19.2.6, 19.3.2, or later, which restores proper limits to the GraphQL complexity calculation.

The CVSS score of 7.5 indicates a high severity, while the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw external GraphQL queries, an attacker could potentially deny service to a system administrator or project maintainer, thus impacting the availability of repository services. Given the lack of an EPSS estimate, the precise likelihood of exploitation remains uncertain, but the absence of a current fix in the target environment makes this a critical maintenance issue.