CVE-2025-12571: GitLab Denial of Service Vulnerability

CVE-2025-12571 Overview

CVE-2025-12571 is a denial of service vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw allows an unauthenticated remote attacker to exhaust server resources by sending specifically crafted requests containing malicious JSON payloads. GitLab has released patches addressing the issue across multiple supported branches.

The vulnerability impacts all GitLab versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1. The weakness maps to [CWE-770] Allocation of Resources Without Limits or Throttling. No authentication or user interaction is required to trigger the condition.

Critical Impact
Unauthenticated attackers can render GitLab instances unavailable by submitting malformed JSON payloads over the network, disrupting source code management, CI/CD pipelines, and developer workflows.

Affected Products

GitLab Community Edition (CE) versions 17.10 through 18.4.4
GitLab Enterprise Edition (EE) versions 18.5 through 18.5.2
GitLab CE/EE version 18.6.0

Discovery Timeline

2025-11-26 - GitLab releases patch versions 18.4.5, 18.5.3, and 18.6.1
2025-11-26 - CVE-2025-12571 published to the National Vulnerability Database
2025-12-10 - Last updated in NVD database

Technical Details for CVE-2025-12571

Vulnerability Analysis

The vulnerability stems from improper resource limiting when GitLab parses incoming JSON request bodies. An unauthenticated attacker can craft JSON payloads that force the application to consume disproportionate CPU, memory, or processing time during deserialization. Repeated submission of such payloads exhausts server resources and renders the GitLab instance unresponsive to legitimate users.

The weakness is classified under [CWE-770] Allocation of Resources Without Limits or Throttling. This class of flaw occurs when an application fails to enforce upper bounds on the cost of operations driven by untrusted input. In web-facing applications such as GitLab, parsing endpoints accessible without authentication present a high-value target for resource exhaustion attacks.

Root Cause

The root cause is the absence of sufficient validation and throttling on JSON payload structure or size before processing. Inputs that nest deeply, contain large arrays, or otherwise exercise expensive parsing paths are accepted and processed without an early rejection mechanism, allowing the work performed per request to grow unbounded.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends HTTP requests with malicious JSON payloads to an internet-reachable GitLab endpoint. Because authentication is not required, exposed instances can be targeted directly. Sustained traffic of these crafted requests degrades availability of the GitLab service. Refer to the GitLab Patch Release Notes and the HackerOne Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-12571

Indicators of Compromise

Sudden spikes in CPU or memory utilization on GitLab application servers (Puma, Sidekiq, Workhorse) without a corresponding increase in legitimate user activity.
HTTP 5xx errors, request timeouts, or worker restarts observed in production.log, production_json.log, and gitlab-workhorse logs.
Repeated POST requests from a single source IP or small set of IPs containing oversized or deeply nested JSON bodies.

Detection Strategies

Inspect web access logs for unusually large Content-Length values on JSON endpoints and correlate with worker timeouts.
Deploy a Web Application Firewall (WAF) rule that flags JSON payloads exceeding nesting depth or array length thresholds.
Monitor reverse proxy metrics (NGINX, HAProxy) for elevated request durations to GitLab API and Git LFS endpoints.

Monitoring Recommendations

Establish baseline performance metrics for GitLab worker processes and alert on sustained deviations.
Track unauthenticated request rates per source IP and apply rate-limiting where business needs allow.
Forward GitLab application and proxy logs to a centralized analytics platform to detect cross-instance abuse patterns.

How to Mitigate CVE-2025-12571

Immediate Actions Required

Upgrade self-managed GitLab CE/EE instances to 18.6.1, 18.5.3, or 18.4.5 depending on the deployed major branch.
Restrict network exposure of GitLab to trusted networks or place the instance behind a WAF until patching is complete.
Review historical access logs for evidence of exploitation attempts prior to upgrading.

Patch Information

GitLab released fixed versions 18.6.1, 18.5.3, and 18.4.5 on 2025-11-26. GitLab.com is already running the patched code. Self-managed administrators should follow the upgrade procedure published in the GitLab Patch Release Notes. Additional issue tracking is available in the GitLab Issue Tracker Entry.

Workarounds

Enforce request body size limits and JSON depth restrictions at the reverse proxy or WAF layer.
Apply aggressive rate limiting on unauthenticated endpoints that accept JSON input.
Limit external network access to the GitLab instance through firewall or VPN segmentation until the upgrade is applied.

bash

# Example NGINX configuration to cap request body size in front of GitLab
http {
    client_max_body_size 1m;
    client_body_timeout 10s;

    limit_req_zone $binary_remote_addr zone=gitlab_api:10m rate=10r/s;

    server {
        listen 443 ssl;
        server_name gitlab.example.com;

        location /api/ {
            limit_req zone=gitlab_api burst=20 nodelay;
            proxy_pass http://gitlab_upstream;
        }
    }
}