GitLab implements a resource exhaustion flaw that allows an authenticated user to upload a malicious file and repeatedly query it through GraphQL, causing the application to allocate memory and CPU resources without limit, ultimately resulting in a denial of service.

The affected product is GitLab Enterprise Edition. All GitLab EE releases from version 15.6 up to, but not including, 18.6.6; version 18.7 up to, but not including, 18.7.4; and version 18.8 up to, but not including, 18.8.4 are impacted. The vendor recommends upgrading to GitLab 18.6.6, 18.7.4, 18.8.4 or later to remediate the issue.

The CVSS score of 6.5 indicates a moderate to high severity. The EPSS score of less than 1% implies a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker would need authenticated access to the system and must repeatedly execute GraphQL queries targeting a maliciously uploaded file. If these requests are unthrottled, the application can become overwhelmed, leading to service interruption for users.