GitLab has a flaw where a lack of proper sanitization can allow an authenticated user to trigger a denial‑of‑service on the CI/CD Catalog page. The vulnerability is a classic example of CWE‑1021, resulting in an interruption of service rather than disclosure or modification of data. Attackers who can log in to a GitLab instance can cause the catalog page to repeatedly fail to render, potentially halting build and deployment workflows.

All GitLab Community Edition and Enterprise Edition releases from version 17.0 up to 18.10.7, from 18.11.0 up to 18.11.4, and from 19.0.0 up to 19.0.1 are affected. The CVE notes that versions before 18.10.8, 18.11.5, and 19.0.2 contain the issue.

The CVSS score is 4.3, placing the flaw in the moderate range. No EPSS value is listed, so exploitation likelihood cannot be quantified, and the vulnerability is not currently in CISA’s KEV catalog. Because the attack requires authentication, the threat is limited to users who already have valid credentials, but the impact can disrupt automated pipelines and hinder availability for teams relying on the catalog feature. The risk is moderate due to the combination of moderate severity and restricted attack surface.