CVE-2025-10094: GitLab CE/EE Token Name DoS Vulnerability

CVE-2025-10094 Overview

CVE-2025-10094 is a denial-of-service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). Authenticated users can create access tokens with excessively large names, disrupting token listing endpoints and related administrative operations. The flaw affects GitLab versions from 10.7 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2. The weakness is tracked as [CWE-1284: Improper Validation of Specified Quantity in Input]. GitLab patched the issue in the 18.3.2 release published on September 10, 2025.

Critical Impact
Any authenticated GitLab user can render token administration functionality unavailable, blocking access to token listings and impeding administrative workflows that depend on those endpoints.

Affected Products

GitLab Community Edition (CE) versions 10.7 through 18.1.5
GitLab Enterprise Edition (EE) versions 18.2 through 18.2.5
GitLab CE/EE versions 18.3 through 18.3.1

Discovery Timeline

2025-09-10 - GitLab releases patch version 18.3.2 addressing the issue
2025-09-12 - CVE-2025-10094 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10094

Vulnerability Analysis

The vulnerability resides in the GitLab token creation workflow. GitLab did not enforce a reasonable upper bound on the name attribute of access tokens supplied by authenticated users. When a user creates a token with an oversized name, downstream operations that enumerate or render tokens consume excessive resources. Requests to list tokens or perform administrative operations that iterate token metadata fail or time out.

The classification [CWE-1284] describes improper validation of specified quantity in input, which precisely matches this flaw. Attackers do not need elevated privileges to trigger the condition. A standard authenticated account with the ability to create personal, project, or group access tokens is sufficient. Because the corrupted state persists once tokens are created, the impact continues until administrators locate and remove the offending records.

Root Cause

GitLab lacked length validation on the token name field at the input boundary. The application accepted arbitrarily large strings and stored them without truncation or rejection. Subsequent code paths that read token records did not defensively cap the size of data returned or rendered, allowing a single malformed record to disrupt entire listing operations.

Attack Vector

An attacker authenticates to a vulnerable GitLab instance and issues an API request to create an access token whose name parameter contains an excessively large payload. Once persisted, any request that lists tokens for the affected scope fails to complete. See the HackerOne Report #3049089 and GitLab Issue #528469 for additional technical context.

Detection Methods for CVE-2025-10094

Indicators of Compromise

Access token records in the GitLab database with name fields significantly larger than typical user-generated values
Application errors, timeouts, or 5xx responses when accessing token administration endpoints such as /api/v4/personal_access_tokens or the UI token pages
Elevated database query latency correlating with reads against the personal_access_tokens, project_access_tokens, or group_access_tokens tables

Detection Strategies

Audit GitLab API access logs for POST requests to token creation endpoints containing unusually large request bodies
Query the GitLab database directly for token rows where LENGTH(name) exceeds a sane threshold such as 255 characters
Correlate authenticated user activity with subsequent failures on token listing endpoints to identify the responsible account

Monitoring Recommendations

Ingest GitLab production logs and Rails application logs into a centralized analytics platform to alert on repeated errors from token controllers
Track HTTP request payload sizes at the reverse proxy or web application firewall and alert on outliers targeting /api/v4/*_access_tokens
Monitor administrative user complaints or ticket volume relating to token pages, which often precedes formal identification

How to Mitigate CVE-2025-10094

Immediate Actions Required

Upgrade GitLab to 18.3.2, 18.2.6, or 18.1.6 or later according to the deployment branch
Inventory existing access tokens and remove any records with abnormally large name values that predate the upgrade
Review authentication logs to identify accounts that created oversized tokens and investigate for further abuse

Patch Information

GitLab addressed the vulnerability in the GitLab 18.3.2 Patch Release published on September 10, 2025. Corresponding fixes were shipped to the 18.2 and 18.1 branches as 18.2.6 and 18.1.6. Self-managed administrators should apply the patch matching their current major.minor version.

Workarounds

Restrict token creation permissions to trusted users through GitLab role and group policies until patching is complete
Enforce request body size limits at an upstream reverse proxy such as NGINX or a WAF to reject oversized token creation payloads
Periodically scan the token tables for oversized name values and delete offending rows to restore listing functionality

bash

# Example: enforce a client request body limit in NGINX in front of GitLab
# Add to the server or location block that proxies to GitLab
client_max_body_size 1m;
large_client_header_buffers 4 8k;