Technical impact
GitLab includes an inefficient algorithmic flaw in its GraphQL request processing that weakens the system’s ability to handle malformed or overly complex queries. An unauthenticated attacker can exploit this by crafting a specialized GraphQL payload that forces the server to perform excessive computation, ultimately exhausting resources and rendering the instance unresponsive. The weakness is a classic example of a poor algorithmic complexity problem (CWE‑407) and directly impacts availability.
Affected Systems
This vulnerability is present in GitLab Community Edition and Enterprise Edition from version 18.5 through just before the patched releases of 18.8.7, 18.9.3, and 18.10.1. Both the community and enterprise variants of each affected version are susceptible, while any release equal to or newer than the mentioned patch numbers is considered safe.
Risk and Exploitability
The CVSS score of 7.5 classifies the flaw as high severity, yet the EPSS score of less than 1% and its absence from the CISA KEV catalog suggest limited current exploitation. The likely attack vector is over the public GraphQL endpoint; an attacker does not need authentication or special permissions, simply sending crafted queries that trigger the algorithmic inefficiency and cause service disruption.
