CVE-2025-0186: GitLab Denial of Service Vulnerability

CVE-2025-0186 Overview

CVE-2025-0186 is a denial of service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). An authenticated user can exhaust server resources by sending crafted requests to a discussions endpoint. The flaw affects all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1. GitLab released patches on April 22, 2026. The weakness is tracked as [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
Authenticated attackers can degrade or disrupt GitLab instance availability by triggering resource exhaustion through a discussions endpoint, impacting development and CI/CD pipelines that depend on the platform.

Affected Products

GitLab CE/EE versions 10.6 through 18.9.5
GitLab CE/EE versions 18.10 through 18.10.3
GitLab CE/EE version 18.11.0

Discovery Timeline

2026-04-22 - GitLab releases patch versions 18.9.6, 18.10.4, and 18.11.1
2026-04-22 - CVE-2025-0186 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-0186

Vulnerability Analysis

The vulnerability resides in a GitLab discussions endpoint that processes user-supplied requests without sufficient resource limits. An authenticated user submits crafted requests that force the server to allocate excessive CPU, memory, or backend resources. Sustained requests degrade responsiveness or render the instance unavailable to other users.

The flaw is categorized under [CWE-770], which describes the absence of limits or throttling on resource allocation. Because authentication is required, the attack surface is restricted to users with valid GitLab accounts. However, in environments that permit self-registration or contain many low-privilege accounts, the effective exposure is large.

The attack vector is network-based with low complexity and requires no user interaction. The impact is limited to availability — confidentiality and integrity are not affected.

Root Cause

The root cause is missing input validation and missing throttling on a discussions API endpoint. Requests are accepted and processed without bounds checks on the amount of work or memory the server commits per request. Repeated or specially shaped requests amplify backend load until resources are depleted.

Attack Vector

An attacker authenticates to the target GitLab instance with any valid account. The attacker then issues crafted HTTP requests to the affected discussions endpoint. Each request causes disproportionate server-side resource consumption. With minimal request volume, the attacker degrades service for all users on the instance.

No public proof-of-concept is available. Technical details are referenced in GitLab Work Item #511312 and HackerOne Report #2915694.

Detection Methods for CVE-2025-0186

Indicators of Compromise

Unusual spikes in CPU or memory utilization on GitLab Rails and Sidekiq workers without correlating CI/CD activity
Elevated request rates from a single authenticated user against /api/v4/projects/*/discussions or related discussion endpoints
HTTP 5xx errors, gateway timeouts, or worker restarts in gitlab-rails/production.log and gitlab-workhorse logs

Detection Strategies

Correlate authenticated user IDs with request volume and response latency on discussion endpoints to identify abuse
Alert on sustained per-user request rates that exceed normal application usage baselines
Review GitLab application logs for repeated long-running requests targeting discussions resources

Monitoring Recommendations

Forward GitLab application, Workhorse, and reverse-proxy logs to a centralized log platform for query and alerting
Track Prometheus metrics for Rails request duration, Sidekiq queue depth, and Puma worker saturation
Establish alert thresholds for sudden availability degradation tied to specific API paths and user identifiers

How to Mitigate CVE-2025-0186

Immediate Actions Required

Upgrade to GitLab CE/EE 18.9.6, 18.10.4, or 18.11.1 as documented in the GitLab Patch Release Announcement
Audit user accounts and disable self-registration where it is not required
Review reverse proxy and WAF rules to enforce per-user rate limits on the GitLab API

Patch Information

GitLab published fixed releases on April 22, 2026. Patched versions are 18.9.6, 18.10.4, and 18.11.1. Administrators of self-managed instances should upgrade promptly. GitLab.com SaaS users are already running the patched code. Full release notes are available in the GitLab Patch Release Announcement.

Workarounds

Apply network or reverse-proxy rate limiting on the affected discussions endpoint until upgrades complete
Restrict account creation and revoke unused or suspicious accounts to reduce the authenticated attack surface
Enable GitLab application-level rate limits under Admin Area → Settings → Network → User and IP rate limits

bash

# Example NGINX rate limit for GitLab discussions endpoints
limit_req_zone $http_authorization zone=gitlab_discussions:10m rate=10r/s;

location ~ ^/api/v4/projects/.*/discussions {
    limit_req zone=gitlab_discussions burst=20 nodelay;
    proxy_pass http://gitlab-workhorse;
}