GitLab introduced a flaw where freshly uploaded markdown could be processed without any limits, resulting in exponential growth in processing time and CPU consumption. An unauthenticated user can trigger this by crafting a special markdown file, leading to a denial of service that impairs the availability of the entire instance. The weakness is a classic example of Resource Exhaustion, categorized as CWE-770.

GitLab Community and Enterprise editions are affected. Versions 18.7 and 18.8 that fall below the patch releases 18.7.4 and 18.8.4 are vulnerable. All earlier 18.7.x and 18.8.x deployments must be upgraded to the indicated versions or later.

The vulnerability has a CVSS score of 6.5, indicating a moderately high severity impact and exploitation difficulty. EPSS is less than 1%, suggesting that the likelihood of real-world exploitation is currently low, and the issue is not listed in the CISA KEV catalog. Attackers need only an unauthenticated web session and can submit a markdown file to the preview endpoint. The vulnerability does not require privileged access or remote code execution; it simply taxes system resources until the instance becomes unusable.