Denial of Service in GitLab CE/EE GraphQL API

A successful exploit allows an authenticated user to consume excessive server resources through the GitLab GraphQL API, potentially causing denial of service. The likely impact is degradation or interruption of GitLab availability for legitimate users, including possible slowdown, instability, or temporary unavailability of affected services depending on deployment size and resource constraints.

If immediate patching is not possible, reduce exposure to the GraphQL API where operationally feasible, restrict access to trusted authenticated users only, and apply rate limiting, request throttling, and resource monitoring around GitLab application traffic to reduce the likelihood and impact of resource-exhaustion attempts. Because exploitation requires authentication, tightening account provisioning and monitoring for abusive GraphQL usage may also help limit risk until upgrades can be applied.

Upgrade GitLab CE/EE to a fixed release: 18.9.6 or later, 18.10.4 or later, or 18.11.1 or later, depending on the supported upgrade path in use. These versions remediate the insufficient resource allocation limits in the GraphQL API.