GitLab versions before 18.7.5, 18.8.5, and 18.9.1 may run a regular expression on data submitted to a merge request endpoint, allowing an attacker to send specially crafted input that causes the expression to backtrack heavily. The resulting CPU and memory consumption can disrupt service availability for the repository host. This flaw is a classic regular‑expression denial of service, identified as CWE‑1333.

All GitLab Community and Enterprise Editions from version 9.2 up to, but not including, 18.7.5, 18.8.5, and 18.9.1 are affected. The vulnerability applies to merge request operations across both community and enterprise deployments, regardless of the underlying operating system or operating mode.

The vulnerability carries a CVSS score of 7.5, indicating a high impact. The EPSS score is listed as < 1%, so the likelihood of real‑world exploitation is low at present, and the issue is not yet cataloged in CISA’s KEV list. However, because the flaw can be triggered by an unauthenticated user via a standard HTTP API call to the merge request endpoint, it is easily reachable over the network. If exploited, an attacker could slow or freeze the GitLab instance until resources are exhausted or until the service is restored. Given the higher severity and the availability of a public fix, the risk demands prompt mitigation.