GitLab's resource management for merge request discussions has an unchecked allocation flaw that can allow an unauthenticated attacker to exhaust server resources during normal processing. This vulnerability is classified as CWE-770, which highlights unbounded resource allocation. When triggered, the flaw can lead to a denial of service, rendering the GitLab instance unavailable to legitimate users.

The affected vendor is GitLab. All community and enterprise editions from version 11.8 up through 19.0.4, 19.1.2, and 19.2.0 are impacted. Users on earlier releases have no risk, while those on 19.0.5, 19.1.3, 19.2.1 or later have the fix applied and are not vulnerable.

The CVSS base score of 7.5 reflects a high severity, though the EPSS score of less than 1% indicates that current exploitation activity is very low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated request that triggers the merge request discussion processing path; the attacker would craft a request that creates many nested discussions to deplete memory or CPU resources. While the exact exploitation technique is not detailed, the description infers that the flaw is exploitable under specific conditions that force the application to allocate resources without limits.