GitLab’s resource allocation flaw allows an authenticated user to trigger a denial of service by uploading a specially crafted file that consumes excessive CPU or memory without any limits or throttling. The vulnerability is classified as CWE‑770 and can cause the application to become unresponsive, affecting confidentiality and integrity if the service is unavailable to legitimate users.

The issue impacts GitLab Community and Enterprise Editions from version 17.10 up to but not including 18.10.8, 18.11.5, and 19.0.2. Users running these older releases are at risk if they have enabled file upload features for authenticated accounts.

The CVSS score of 6.5 indicates a moderate severity, but because the flaw requires authenticated access and a specific upload scenario, the likelihood of exploitation is low in the absence of a public exploit. The vulnerability is not listed in CISA KEV and no EPSS score is available. If an attacker can sidestep or abuse upload controls within GitLab, they could cause repetitive service disruption and potentially exhaust resources, leading to a denial of service for all users.