The vulnerability arises from a lack of resource limits or throttling for an internal import endpoint. An attacker who authenticates to GitLab can repeatedly trigger the Bitbucket Server import feature with large responses, allowing them to exhaust memory or processing resources and bring the application to a halt.

Affected products include GitLab Community Edition and Enterprise Edition. Vulnerable versions are all releases from 11.2 up to, but not including, 18.7.5; from 18.8.0 to 18.8.4; and the 18.9.0 release. The issue was fixed in GitLab 18.7.5, 18.8.5, and 18.9.1 respectively.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation is unlikely at present. The vulnerability is not in the CISA KEV list. Exploitation requires valid user credentials and leverages the import endpoint to flood server resources. Administrators should therefore upgrade promptly or temporarily restrict that endpoint.