GitLab Enterprise Edition contains a flaw in GraphQL query handling that allows an authenticated user to submit improperly validated input. The vulnerability can cause the GitLab instance to enter a state that results in denial of service, preventing legitimate users from accessing the platform. The weakness is a form of insufficient input validation, identified as CWE‑1284, which undermines the availability of the service for all affected users.

The issue affects all GitLab EE installations running versions from 18.2 up to 18.8.8, from 18.9 up to 18.9.4, and from 18.10 up to 18.10.2. No other vendors or products are listed as impacted.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% shows that the likelihood of exploitation is low. The vulnerability is not listed in CISA’s KEV catalog, implying it has not yet been widely reported as exploited. Because the attack requires authentication, the attacker must first obtain valid credentials to the GitLab instance. Successful exploitation will lead to service disruption, but does not compromise data confidentiality or integrity. The mitigation path is clear: upgrade to version 18.8.9, 18.9.5, 18.10.3 or any newer release.