Denial of Service in GitLab Protected Branches API

Successful exploitation can cause a denial-of-service condition in GitLab by crashing or otherwise disrupting the protected branches API processing path. This can reduce availability of the affected GitLab service and interrupt normal administrative or development workflows that depend on the API. The provided content does not indicate code execution, privilege escalation, or data exposure.

If immediate patching is not possible, reduce exposure to the protected branches API by restricting network access to trusted users and administrative networks, and place the instance behind filtering or rate-limiting controls to reduce the likelihood of repeated malicious requests. Because the issue is exploitable without authentication, limiting public reachability of the affected API surface is the most relevant temporary mitigation based on the available information.

Upgrade GitLab CE/EE to a fixed release: 18.7.6 or later in the 18.7 series, 18.8.6 or later in the 18.8 series, or 18.9.2 or later in the 18.9 series. GitLab urged self-managed administrators to apply the patches immediately. GitLab.com and GitLab Dedicated are already patched according to the provided content.