GitLab versions prior to 19.1.8, 19.2.6, and 19.3.2 contain a flaw in the GraphQL complexity calculation that fails to enforce limits on resource allocation Graph consumption, eventually exhausting system resources and causing GitLab services to become unresponsive. This weakness is identified as CWE-770 and is rated with a CVSS score of 7.5.

All Community Edition and Enterprise Edition releases from 18.4.6 up to, but not including, 19.1.8, all 19.2.x releases before 19.2.6, and all 19.3.x releases before 19.3.2 are affected. The vendor has released patches in GitLab 19.1.8, 19.2.6, 19.3.2 and later to address the issue.

The EPSS score is less than 1 percent, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the flaw can be triggered without authentication over the network; any external client can send a malicious GraphQL request that forces resource exhaustion. While exploitation likelihood is low, the potential impact on service availability remains high for exposed installations, underscoring the importance of applying the vendor fix promptly.