CVE-2025-13078: GitLab Webhook DOS Vulnerability

CVE-2025-13078 Overview

A denial of service vulnerability has been identified in GitLab CE/EE that affects all versions from 16.10 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1. This vulnerability allows an authenticated user to cause excessive resource consumption when processing certain webhook configuration inputs, potentially leading to service degradation or unavailability.

Critical Impact

Authenticated attackers can exhaust server resources through malicious webhook configurations, causing denial of service conditions that may impact GitLab instance availability for all users.

Affected Products

• GitLab Community Edition (CE) versions 16.10 to 18.8.6
• GitLab Enterprise Edition (EE) versions 16.10 to 18.8.6
• GitLab CE/EE versions 18.9 to 18.9.2
• GitLab CE/EE version 18.10.0

Discovery Timeline

• 2026-03-25 - CVE-2025-13078 published to NVD
• 2026-03-25 - GitLab releases security patch in version 18.10.1
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2025-13078

Vulnerability Analysis

This vulnerability is classified under CWE-1284 (Improper Validation of Specified Quantity in Input), indicating that the GitLab webhook configuration processing lacks proper validation of input quantities or sizes. When an authenticated user submits specially crafted webhook configuration inputs, the system fails to adequately constrain resource allocation, leading to excessive CPU or memory consumption.

The attack can be executed over the network by any authenticated user, requiring no special privileges beyond basic authentication. The impact is limited to availability—there is no confidentiality or integrity breach—but the potential for complete service disruption makes this a significant concern for organizations relying on GitLab for development workflows.

Root Cause

The root cause lies in improper validation of webhook configuration parameters. The affected code path does not enforce adequate limits on the size, complexity, or quantity of webhook configuration data that can be submitted. This allows attackers to craft inputs that trigger resource-intensive processing operations, consuming excessive server resources.

Attack Vector

The vulnerability is exploited through the network by authenticated users who can access webhook configuration functionality. The attack requires:

1. Valid authentication credentials to the GitLab instance
2. Access to webhook configuration features (typically available to project maintainers)
3. Submission of maliciously crafted webhook configuration data

The attack does not require user interaction and can be automated once an attacker has obtained valid credentials. The vulnerability affects the webhook configuration processing pipeline, where insufficient input validation allows resource exhaustion attacks.

Additional technical details can be found in the GitLab Work Item #580488 and HackerOne Report #3413704.

Detection Methods for CVE-2025-13078

Indicators of Compromise

• Unusual spikes in CPU or memory usage on GitLab application servers
• Abnormally large or complex webhook configuration requests in application logs
• Repeated webhook configuration modifications from specific user accounts
• Server slowdowns or timeouts correlating with webhook-related operations

Detection Strategies

• Monitor GitLab application logs for excessive webhook configuration API calls from individual users
• Implement rate limiting alerts for webhook-related endpoints
• Track resource utilization metrics (CPU, memory) on GitLab servers with anomaly detection
• Review audit logs for unusual patterns in webhook creation or modification activities

Monitoring Recommendations

• Enable detailed logging for webhook configuration changes in GitLab
• Set up alerts for resource exhaustion conditions on GitLab application servers
• Monitor for authentication attempts followed by rapid webhook configuration requests
• Implement network-level monitoring for anomalous traffic patterns to GitLab webhook endpoints

How to Mitigate CVE-2025-13078

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.10.1, 18.9.3, or 18.8.7 depending on your version branch
• Review recent webhook configurations for suspicious or unusually complex entries
• Audit user accounts with webhook configuration permissions
• Consider temporarily restricting webhook creation permissions to trusted administrators

Patch Information

GitLab has released security patches addressing this vulnerability in the following versions:

• GitLab 18.10.1 (for 18.10.x branch)
• GitLab 18.9.3 (for 18.9.x branch)
• GitLab 18.8.7 (for 16.10.x through 18.8.x branches)

Organizations should apply the appropriate patch based on their current GitLab version. Refer to the GitLab Patch Release 18.10.1 for complete details and upgrade instructions.

Workarounds

• Implement rate limiting on webhook configuration endpoints at the load balancer or reverse proxy level
• Restrict webhook creation and modification permissions to essential personnel only
• Deploy resource monitoring and automatic alerting for GitLab server resource exhaustion
• Consider implementing a Web Application Firewall (WAF) rule to limit webhook configuration request sizes

# Example: NGINX rate limiting for webhook endpoints
# Add to your GitLab NGINX configuration

# Define rate limit zone for webhook endpoints
limit_req_zone $binary_remote_addr zone=webhook_limit:10m rate=5r/m;

# Apply to webhook configuration paths
location ~ ^/api/v4/projects/[0-9]+/hooks {
    limit_req zone=webhook_limit burst=2 nodelay;
    proxy_pass http://gitlab-workhorse;
}