CVE-2025-10867: GitLab GraphQL API DOS Vulnerability

CVE-2025-10867 Overview

CVE-2025-10867 is a denial-of-service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 18.1 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. An authenticated user can exhaust server resources by issuing repeated requests against an unprotected GraphQL API endpoint. The weakness is classified as [CWE-770] Allocation of Resources Without Limits or Throttling. Successful exploitation degrades or halts service availability for other GitLab users on the instance.

Critical Impact
Authenticated attackers can trigger a denial-of-service condition against GitLab instances by flooding an unprotected GraphQL API, disrupting availability for all users of the affected instance.

Affected Products

GitLab CE/EE versions 18.1 through 18.2.6
GitLab CE/EE versions 18.3 through 18.3.2
GitLab CE/EE versions 18.4.0

Discovery Timeline

2025-09-26 - CVE-2025-10867 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-10867

Vulnerability Analysis

The vulnerability resides in a GraphQL API endpoint exposed by GitLab CE/EE. The endpoint lacks adequate rate limiting or resource throttling on incoming queries. An authenticated user can repeatedly invoke the endpoint to consume backend compute, memory, or database resources. Sustained request volume exhausts server capacity and prevents legitimate operations from completing.

GitLab's GraphQL layer typically enforces query complexity and rate limits to prevent this class of abuse. In the affected versions, the impacted endpoint did not inherit those protections. The result is an availability impact classified under [CWE-770], where the application allocates resources without applying quantitative bounds.

Because the attack requires only low-privilege authentication and no user interaction, any user account on an affected instance can trigger the condition. This includes accounts obtained through self-registration on public GitLab instances where signup is enabled.

Root Cause

The root cause is missing throttling logic on a specific GraphQL API operation. Without enforced query cost limits, request-per-second caps, or concurrency controls, repeated invocations scale linearly with attacker effort. The backend continues to process each request until system resources are depleted.

Attack Vector

Exploitation occurs over the network against the GitLab web application. The attacker authenticates with any valid account and issues repeated GraphQL requests targeting the vulnerable operation. No specific payload crafting or elevated permissions are required. Details of the exact GraphQL operation are tracked in GitLab Issue #517757.

Detection Methods for CVE-2025-10867

Indicators of Compromise

Sustained spikes in GraphQL request volume from a single authenticated user or session token
Elevated CPU, memory, or database utilization on GitLab application servers correlated with /api/graphql traffic
Increased request latency or 502/503 responses served to unrelated users during traffic bursts

Detection Strategies

Baseline normal GraphQL request rates per user and alert on statistical deviations
Inspect web server and Rails application logs for repeated identical GraphQL operations from the same user identifier
Correlate authentication events with subsequent high-volume API activity to identify abusive sessions

Monitoring Recommendations

Enable GitLab audit logging and forward production_json.log and api_json.log to a centralized log platform
Monitor GitLab application performance metrics for anomalous resource consumption tied to GraphQL workloads
Track user account creation on instances with open registration and flag new accounts that immediately generate high API volume

How to Mitigate CVE-2025-10867

Immediate Actions Required

Upgrade GitLab CE/EE to version 18.2.7, 18.3.3, 18.4.1, or later
Restrict signup on public-facing GitLab instances to reduce the pool of attacker-controlled authenticated accounts
Review recent GraphQL API usage logs for signs of prior abuse against the affected endpoint

Patch Information

GitLab has released fixed versions 18.2.7, 18.3.3, and 18.4.1 that apply throttling to the affected GraphQL operation. Administrators running self-managed GitLab instances should schedule upgrades immediately. GitLab.com hosted customers receive the patch through the vendor's managed update process. Refer to GitLab Issue #517757 for tracking details.

Workarounds

Enforce upstream rate limiting at a reverse proxy or web application firewall for requests to /api/graphql
Disable public user registration to limit the vulnerability to trusted internal users until patching completes
Apply per-IP and per-user request quotas in GitLab's built-in rate limiting settings under Admin Area > Settings > Network

bash

# Configuration example
# Example NGINX rate limit for the GitLab GraphQL endpoint
http {
    limit_req_zone $binary_remote_addr zone=graphql_limit:10m rate=10r/s;

    server {
        location /api/graphql {
            limit_req zone=graphql_limit burst=20 nodelay;
            proxy_pass http://gitlab_workhorse;
        }
    }
}