CVE-2025-11042: GitLab GraphQL DoS Vulnerability

CVE-2025-11042 Overview

A resource exhaustion vulnerability was discovered in GitLab CE/EE affecting all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. The vulnerability allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while using specific GraphQL queries.

Critical Impact

Unauthenticated attackers can exploit this vulnerability remotely to exhaust server CPU resources, causing service disruption for all GitLab users and potentially impacting critical CI/CD pipelines and development workflows.

Affected Products

• GitLab Community Edition (CE) versions 17.2 to 18.2.6
• GitLab Enterprise Edition (EE) versions 17.2 to 18.2.6
• GitLab CE/EE versions 18.3 to 18.3.2
• GitLab CE/EE version 18.4.0

Discovery Timeline

• 2025-09-26 - CVE-2025-11042 published to NVD
• 2025-09-29 - Last updated in NVD database

Technical Details for CVE-2025-11042

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw exists in GitLab's GraphQL API implementation, where certain query constructs can trigger excessive CPU consumption without proper resource constraints. The vulnerability can be exploited remotely over the network without requiring authentication or user interaction, making it particularly dangerous for internet-facing GitLab instances.

The attack exploits the lack of adequate query complexity limits or depth restrictions in the GraphQL endpoint. When a maliciously crafted query is submitted, the server processes it without throttling, consuming CPU cycles excessively and degrading service availability for legitimate users.

Root Cause

The root cause of this vulnerability is the allocation of resources without limits or throttling (CWE-770) in GitLab's GraphQL query processing engine. Specific GraphQL queries can trigger computationally expensive operations that lack appropriate resource bounds, allowing attackers to monopolize server CPU resources.

Attack Vector

The attack is network-accessible and requires no authentication or privileges. An attacker can craft specific GraphQL queries targeting GitLab's GraphQL endpoint that cause disproportionate CPU usage relative to the query size. This allows a remote attacker to effectively deny service to legitimate users by exhausting available CPU resources on the GitLab server.

The vulnerability can be exploited by sending crafted GraphQL queries to the /api/graphql endpoint. Technical details and discussion are available in the GitLab Issue Discussion.

Detection Methods for CVE-2025-11042

Indicators of Compromise

• Unusual spikes in CPU utilization on GitLab application servers
• High volume of GraphQL API requests from single IP addresses or unusual sources
• Slow response times or timeouts on the GitLab web interface and API endpoints
• Increased error rates in GitLab application logs related to timeouts or resource exhaustion

Detection Strategies

• Monitor GraphQL endpoint (/api/graphql) request patterns for anomalous query structures or request volumes
• Implement rate limiting and anomaly detection on API endpoints
• Configure alerting for sustained high CPU usage on GitLab servers
• Review GitLab production logs for repeated complex or deeply nested GraphQL queries

Monitoring Recommendations

• Deploy application performance monitoring (APM) to track GraphQL query execution times and resource consumption
• Set up automated alerts for CPU utilization exceeding baseline thresholds on GitLab instances
• Monitor network traffic patterns for unusual request volumes to the GraphQL API
• Implement log aggregation and analysis for early detection of exploitation attempts

How to Mitigate CVE-2025-11042

Immediate Actions Required

• Upgrade GitLab CE/EE to patched versions: 18.2.7, 18.3.3, or 18.4.1 immediately
• Implement rate limiting on the GraphQL API endpoint if immediate patching is not possible
• Monitor for signs of active exploitation such as CPU spikes or slow performance
• Consider temporarily restricting access to the GraphQL API for untrusted networks

Patch Information

GitLab has released security patches to address this vulnerability. Organizations should upgrade to one of the following fixed versions:

• GitLab 18.2.7 for the 18.2.x release series
• GitLab 18.3.3 for the 18.3.x release series
• GitLab 18.4.1 for the 18.4.x release series

Refer to the GitLab Issue Discussion for additional patch details and release notes.

Workarounds

• Implement Web Application Firewall (WAF) rules to filter or limit complex GraphQL queries
• Apply network-level rate limiting to the /api/graphql endpoint
• Restrict GraphQL API access to authenticated users only if business requirements permit
• Deploy reverse proxy query complexity analysis to block potentially malicious queries

# Example: NGINX rate limiting configuration for GitLab GraphQL endpoint
# Add to your NGINX configuration for GitLab

limit_req_zone $binary_remote_addr zone=graphql_limit:10m rate=10r/s;

location /api/graphql {
    limit_req zone=graphql_limit burst=20 nodelay;
    limit_req_status 429;
    proxy_pass http://gitlab-workhorse;
}