This vulnerability arises from deserialization of untrusted data that allows an unauthenticated user to upload a specially crafted file causing a denial of service in GitLab Enterprise Edition. The flaw stems from inadequate validation of uploaded content, which can exhaust resources or corrupt the state of the application, ultimately interrupting availability. The weakness is classified under CWE‑502, indicating an insecure deserialization flaw.

The affected product is GitLab Enterprise Edition across multiple major releases. Versions prior to 18.9.7, specifically 11.9 through 18.8, as well as 18.10 versions older than 18.10.6 and 18.11 versions older than 18.11.3, are vulnerable. All other release lines are considered unaffected.

The CVSS score of 6.5 indicates moderate severity, with no presence in the CISA KEV catalog and an unavailable EPSS score. An attacker does not need authentication to coerce the vulnerability through the standard file upload path, thereby posing a risk to the availability of the entire GitLab instance. Although the exploit does not grant code execution, the potential for sustained outages makes the risk of exploitation non-negligible in environments with high availability requirements.