CVE-2025-10903: GitLab EE SCIM Provisioning DoS Vulnerability

CVE-2025-10903 Overview

CVE-2025-10903 is a denial of service vulnerability in GitLab Enterprise Edition (EE). The flaw resides in the System for Cross-domain Identity Management (SCIM) user provisioning feature. An authenticated user can send specially crafted input that triggers an unbounded loop [CWE-835], exhausting server resources. The issue affects all GitLab EE versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1. GitLab remediated the issue in the 19.3.1, 19.2.5, and 19.1.7 patch releases.

Critical Impact

Authenticated attackers can degrade or halt GitLab EE availability by abusing SCIM provisioning input handling to trigger an infinite loop.

Affected Products

• GitLab EE versions 11.10 through 19.1.6
• GitLab EE versions 19.2 through 19.2.4
• GitLab EE versions 19.3 through 19.3.0

Discovery Timeline

• 2026-08-26 - CVE-2025-10903 published to NVD
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2025-10903

Vulnerability Analysis

The vulnerability is a loop with an unreachable exit condition [CWE-835] inside GitLab EE's SCIM user provisioning code path. SCIM is the standard protocol GitLab uses to synchronize user identities from external identity providers. When the SCIM endpoint receives a specially crafted request, control flow enters a loop whose termination condition never evaluates true. The process consumes CPU indefinitely and blocks worker threads from servicing legitimate requests.

Because the attack targets a shared application worker, sustained exploitation can degrade responsiveness across the entire GitLab instance. Repeated requests amplify the effect, producing a denial of service against integrity of availability.

Root Cause

The root cause is insufficient input validation on data processed by the SCIM provisioning routine. Untrusted attribute values reach an iterative construct that lacks bounded iteration guards or timeout enforcement. The fix constrains the loop and validates input structure before iteration begins.

Attack Vector

Exploitation requires network access to the GitLab EE SCIM endpoint and authenticated credentials with permission to invoke user provisioning. The attacker submits a crafted SCIM payload containing input that drives the vulnerable loop. No user interaction is required and complexity is low. Confidentiality and integrity are not impacted, but availability degradation is high.

Detailed technical information is available in GitLab Work Item #571842 and HackerOne Report #3292470.

Detection Methods for CVE-2025-10903

Indicators of Compromise

• Sustained CPU saturation on GitLab Sidekiq or Puma worker processes without a corresponding increase in legitimate traffic.
• Repeated HTTP requests to /api/scim/v2/ endpoints from a single authenticated session or token.
• Elevated request latency and worker thread exhaustion warnings in GitLab application logs.

Detection Strategies

• Monitor GitLab production.log and api_json.log for anomalous request durations targeting SCIM provisioning routes.
• Correlate authenticated SCIM API calls with worker CPU spikes to identify potentially malicious sessions.
• Alert on SCIM request payloads that deviate from expected identity-provider request shapes and sizes.

Monitoring Recommendations

• Track request rate and duration metrics for /api/scim/v2/Users and related endpoints.
• Enable audit logging for SCIM provisioning operations and forward events to a centralized SIEM.
• Baseline normal SCIM traffic patterns from your identity provider and alert on deviations.

How to Mitigate CVE-2025-10903

Immediate Actions Required

• Upgrade GitLab EE to version 19.3.1, 19.2.5, or 19.1.7 as applicable to your release branch.
• Restrict access to SCIM endpoints to trusted identity-provider source IP ranges using a reverse proxy or WAF.
• Rotate SCIM tokens and audit which accounts hold provisioning privileges.

Patch Information

GitLab released fixes in the 19.3.1, 19.2.5, and 19.1.7 patch releases. Refer to the GitLab Patch Release 19.3.1 advisory for upgrade instructions and version-specific guidance.

Workarounds

• Temporarily disable SCIM user provisioning if the feature is not required for identity synchronization.
• Apply rate limiting on SCIM API endpoints to reduce impact of repeated crafted requests.
• Enforce network-level access control lists that restrict SCIM traffic to authorized identity providers only.

# Example: restrict SCIM endpoint access via NGINX reverse proxy
location /api/scim/ {
    allow 203.0.113.0/24;   # trusted IdP range
    deny all;
    proxy_pass http://gitlab_upstream;
}