The vulnerability originates from insufficient input validation in GitLab’s handling of incoming requests. An unauthenticated user can send specially crafted requests that cause GitLab to allocate resources without any limits or throttling, leading to server resource exhaustion and resulting in a denial of service.

The affected vendor is GitLab, product GitLab. All community and enterprise editions from version 9.0 up to, but not including, 18.9.7, all 18.10 releases before 18.10.6, and all 18.11 releases before 18.11.3 are impacted. Upgrading to 18.9.7, 18.10.6, 18.11.3 or any newer release removes the flaw.

The CVSS score of 7.5 classifies the vulnerability as high severity. Since no EPSS value is published, the exploitation probability cannot be quantified, but the lack of authentication requirement means any external actor can test the issue. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the denial of service by submitting crafted requests from the internet, making the exploitation vector likely to be through HTTP/HTTPS traffic. Implementing safeguards such as rate limiting could reduce impact until a patch is applied.