GitLab has a flaw where optional JSON payloads are not properly validated. An unauthenticated user can send a crafted JSON request that forces the server into an infinite or long loop, exhausting resources and rendering the instance unavailable. The failure stems from improper handling of the quantity field in input, fitting the definition of an input validation weakness (CWE-1284). The result is a denial of service that affects all users of the instance.

All GitLab Community Edition and Enterprise Edition instances from version 12.10 up to 18.8.8, from 18.9 up to 18.9.4, and from 18.10 up to 18.10.2 are vulnerable. Any GitLab server that has not applied the 18.8.9, 18.9.5, 18.10.3, or later patch is at risk.

The CVSS score of 7.5 indicates high severity. The EPSS score of less than 1% suggests low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because denial of service can be achieved by unauthenticated users over the network, an attacker could easily trigger a DoS once the server is reachable. The attack vector is inferred to be an unauthenticated HTTP request to the API that accepts JSON input.