GitLab versions prior to the patched releases contain a flaw in the GraphQL complexity calculation logic that does not enforce limits on resource allocation. A malicious GraphQL query can force the system to allocate excessive resources, eventually exhausting available memory or CPU, and causing GitLab services to become unresponsive.

All GitLab Community Edition and Enterprise Edition releases from 18.4.6 up to, but not including, 19.1.8, all 19.2.x releases before 19.2.6, and all 19.3.x releases before 19.3.2 are affected. The vendor has released patches in GitLab 19.1.8, 19.2.6, 19.3.2 and later to address the issue.

The EPSS score is less than 1 percent, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the flaw can be triggered without authentication over the network; any external client can send a malicious GraphQL request that forces resource exhaustion. While exploitation likelihood is low, the potential impact on service availability remains high for exposed installations, underscoring the importance of applying the vendor fix promptly.