GitLab has a vulnerability that permits an unauthenticated user to upload malicious files under certain conditions, which can lead to a denial of service. The flaw arises from allocating resources without limits or throttling when handling file uploads, allowing an attacker to exhaust server resources. This issue is classified as CWE‑434 (Unrestricted Upload of File with Dangerous Type) and CWE‑770 (Allocation of Resources Without Limits or Throttling).

The vulnerability affects GitLab Community Edition and Enterprise Edition. All releases from version 8.0 up to, but not including, 18.6.6, 18.7.4, and 18.8.4 are impacted. The vendor’s fix is available in GitLab 18.6.6, 18.7.4, 18.8.4 and later releases.

The flaw carries a CVSS score of 6.5, indicating moderate severity. The EPSS score is less than 1%, suggesting a low probability of exploitation, though the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is remote, as the condition can be triggered by uploading files via the public web interface without authentication. Trusted privileges are not required, but the denial of service impact could affect the availability of exposed GitLab instances. Given the moderate difficulty of exploitation and the downstream impact on service availability, the risk is significant for systems lacking the vendor patch or mitigating controls.