The vulnerability allows any unauthenticated user to trigger a denial of service by sending crafted JSON requests that bypass the framework’s validation limits, leading to memory or CPU exhaustion. The flaw is defined as a boundary‑checking failure for untrusted input. It does not provide direct code execution but can disrupt service availability for the entire instance.

GitLab CE and EE instances running any version prior to 18.6.6, 18.7.4, or 18.8.4. Both Community and Enterprise editions are affected, as the issue resides in the core middleware shared by all builds.

The vulnerability scores 7.5 on CVSS, indicating a high‑severity impact. Although the EPSS score is less than 1 %, suggesting a low probability of active exploitation at the time of analysis, the lack of a KEV listing does not mitigate the risk of a viable attack vector. An attacker can send malicious JSON payloads without authentication, which the system would process and potentially exhaust resources, resulting in a service outage.