GitLab GraphQL API High-Severity Vulnerabilities and DoS Risk

GitLab has addressed two high-severity vulnerabilities in its GraphQL API, impacting both Community Edition (CE) and Enterprise Edition (EE) deployments. One of the vulnerabilities, tracked as CVE-2025-10004, allows unauthenticated attackers to launch denial-of-service (DoS) attacks by sending specially crafted GraphQL queries that request large repository blobs. This exploit can exhaust server resources, leading to severe performance degradation or complete unavailability of GitLab services. The vulnerability affects GitLab versions prior to 18.4.2, 18.3.4, and 18.2.8, and administrators are urged to upgrade to these patched versions immediately. The flaw is particularly critical for public-facing GitLab instances, as it does not require authentication to exploit, increasing the risk of opportunistic attacks. The CVE-2025-10004 vulnerability received a CVSS v3.1 base score of 7.5, underscoring its high risk to organizations relying on GitLab for source control and CI/CD pipelines. In addition to CVE-2025-10004, GitLab also patched other high-severity issues in the same update cycle, including vulnerabilities related to GraphQL authorization and JSON file uploads, both of which could also result in DoS conditions. GitLab.com and GitLab Dedicated customers were not affected by these vulnerabilities, as those platforms were either already patched or architecturally isolated from the exposure. The company responded promptly by releasing security updates and providing guidance for self-managed instance administrators. The vulnerabilities could have enabled attackers to disrupt development workflows, potentially creating further security risks during periods of downtime. Security professionals are advised to prioritize patching and to review their exposure, especially for internet-accessible GitLab deployments. The incident highlights the importance of timely vulnerability management in DevOps environments, where service availability is critical. GitLab's swift response and transparent disclosure have been commended by the security community. Organizations are also encouraged to monitor for unusual activity and to implement additional controls to limit the impact of potential DoS attacks. The vulnerabilities were discovered and reported through responsible disclosure channels, enabling GitLab to coordinate a secure and effective patch release. This event serves as a reminder for all DevOps teams to maintain up-to-date software and to stay informed about security advisories affecting their toolchains. The technical details of the vulnerabilities emphasize the need for robust input validation and resource management in API design. GitLab's handling of the incident demonstrates best practices in vulnerability response and communication.