GitLab versions before 18.6.4, 18.7.2, and 18.8.2 may allocate system resources without limits or throttling when processing malformed SSH authentication requests. An unauthenticated attacker can send repeated crafted packets that cause the GitLab server to consume excessive CPU, memory, or file‑descriptor resources, eventually impacting service availability. This flaw represents a resource‑exhaustion weakness (CWE‑770).

Affected products are GitLab Community Edition and Enterprise Edition running any version prior to GitLab 18.6.4, any 18.7 version older than 18.7.2, or any 18.8 version older than 18.8.2. All builds from GitLab 12.3 onward are impacted until the specified patch levels are applied. The vulnerability is present in both the systems that expose SSH for repository access as well as in the internal services that handle SSH authentication.

The CVSS base score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % reflects a very low probability of exploitation at present. GitLab does not list this issue in the CISA KEV catalog, and no public exploits are known. The likely attack vector is network‑based via SSH, whereby an unauthenticated user sends forged authentication requests directly to the GitLab server. Successful exploitation would result in denial of service, disrupting all users until the server is rebooted or resources are manually reclaimed.