CVE-2025-10858: GitLab Denial of Service Vulnerability

CVE-2025-10858 Overview

A Denial of Service (DoS) vulnerability has been discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) that allows unauthenticated attackers to disrupt service availability. The vulnerability exists in the file upload functionality, where specifically crafted large JSON files can be uploaded to trigger resource exhaustion conditions on the GitLab server.

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling), indicating that the application fails to properly limit or throttle resource consumption when processing JSON file uploads. An attacker can exploit this weakness remotely over the network without requiring any authentication or user interaction.

Critical Impact

Unauthenticated attackers can cause service disruption by uploading malicious JSON files, potentially affecting all users and CI/CD pipelines dependent on the GitLab instance.

Affected Products

• GitLab Community Edition (CE) all versions before 18.2.7
• GitLab Enterprise Edition (EE) all versions before 18.2.7
• GitLab CE/EE versions 18.3 before 18.3.3
• GitLab CE/EE versions 18.4 before 18.4.1

Discovery Timeline

• 2025-09-26 - CVE-2025-10858 published to NVD
• 2025-09-29 - Last updated in NVD database

Technical Details for CVE-2025-10858

Vulnerability Analysis

This vulnerability allows unauthenticated remote attackers to exhaust server resources by uploading specially crafted large JSON files to GitLab. The root issue stems from improper resource allocation controls during file processing, where the application does not adequately limit memory or CPU consumption when handling oversized or maliciously structured JSON payloads.

When a large JSON file is uploaded, GitLab's parsing routines may consume excessive memory and processing power attempting to parse the file structure. This can lead to resource starvation for legitimate users and processes, effectively denying service to the entire GitLab instance.

The attack can be executed remotely over the network, requires low complexity to exploit, and does not require any privileges or user interaction. While the vulnerability does not impact confidentiality or integrity, it can completely compromise the availability of the affected system.

Root Cause

The vulnerability is rooted in CWE-770: Allocation of Resources Without Limits or Throttling. GitLab's JSON file upload handling does not implement adequate safeguards to prevent resource exhaustion when processing large or complex JSON structures. The absence of proper input size validation, memory allocation limits, or processing timeouts allows attackers to craft payloads that consume disproportionate system resources.

Attack Vector

The attack can be performed by any unauthenticated user with network access to the GitLab instance. The attacker crafts a malicious JSON file designed to maximize resource consumption during parsing—this could include deeply nested structures, extremely long strings, or repetitive patterns that stress the JSON parser.

The attacker then uploads this file through GitLab's file upload functionality. When the server attempts to process the JSON content, it allocates excessive memory and CPU cycles, potentially causing the service to become unresponsive or crash entirely. Since no authentication is required, this attack can be launched anonymously from any location with network connectivity to the target GitLab server.

Detection Methods for CVE-2025-10858

Indicators of Compromise

• Unusual spikes in memory consumption on GitLab application servers
• Abnormally large JSON file uploads in GitLab access logs
• Multiple failed or timed-out requests from legitimate users during attack periods
• GitLab worker processes consuming excessive CPU resources

Detection Strategies

• Monitor GitLab application logs for large file uploads, particularly JSON files exceeding normal size thresholds
• Implement web application firewall (WAF) rules to detect and block oversized JSON payloads
• Configure alerting on memory utilization thresholds for GitLab application processes
• Review access logs for patterns of repeated file upload attempts from single IP addresses

Monitoring Recommendations

• Enable detailed logging for file upload operations in GitLab configuration
• Set up infrastructure monitoring to track memory, CPU, and disk I/O metrics on GitLab servers
• Configure alerts for sudden degradation in GitLab response times or availability
• Monitor for unauthenticated requests to upload endpoints at unusual volumes

How to Mitigate CVE-2025-10858

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.2.7 or later for the 18.2.x branch
• Upgrade GitLab CE/EE to version 18.3.3 or later for the 18.3.x branch
• Upgrade GitLab CE/EE to version 18.4.1 or later for the 18.4.x branch
• Review and strengthen network access controls to GitLab instances

Patch Information

GitLab has released security patches addressing this vulnerability in versions 18.2.7, 18.3.3, and 18.4.1. Organizations should prioritize upgrading to these patched versions as soon as possible. For additional details and tracking, refer to the GitLab Issue Tracking page.

Workarounds

• Implement rate limiting on file upload endpoints at the load balancer or WAF level
• Configure maximum request body size limits in the web server (nginx/Apache) fronting GitLab
• Restrict network access to GitLab instances using firewall rules to limit exposure
• Enable request timeout configurations to prevent long-running upload processing

# Example nginx configuration to limit request body size
# Add to nginx configuration for GitLab
client_max_body_size 10m;
client_body_timeout 60s;

# Rate limiting configuration
limit_req_zone $binary_remote_addr zone=upload_limit:10m rate=5r/s;
location ~ ^/uploads {
    limit_req zone=upload_limit burst=10 nodelay;
}