The vulnerability is an uncontrolled recursion in GitLab’s GraphQL processing that can be triggered by an unauthenticated user. By sending specially crafted GraphQL requests, an attacker can cause excessive CPU and memory usage, potentially exhausting system resources and resulting in service interruption. This issue, classified as CWE-674, is a denial of service vulnerability.

The issue affects GitLab Community Edition and Enterprise Edition installations running any 18.9 release older than 18.9.2. All affected deployments are covered under the GitLab:GitLab vendor product line as defined in the CPE list.

The CVSS base score of 7.5 classifies this as a high severity vulnerability. The EPSS score is reported as less than 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the denial of service remotely via unauthenticated GraphQL requests as described in the vendor’s advisory.