CVE-2025-13335: GitLab Wiki DoS Vulnerability

CVE-2025-13335 Overview

A denial of service vulnerability has been identified in GitLab CE/EE that allows authenticated users to cause service disruption through malformed Wiki documents. The vulnerability exists in the Wiki document parsing functionality where specially crafted documents can bypass cycle detection mechanisms, leading to resource exhaustion and system unavailability. This issue affects all GitLab versions from 17.1 through multiple release branches.

Critical Impact

Authenticated attackers can disrupt GitLab service availability by creating malformed Wiki documents that exploit the cycle detection bypass, potentially affecting development workflows and CI/CD pipelines across entire organizations.

Affected Products

• GitLab Community Edition (CE) versions 17.1 before 18.6.4
• GitLab Enterprise Edition (EE) versions 17.1 before 18.6.4
• GitLab CE/EE versions 18.7 before 18.7.2
• GitLab CE/EE versions 18.8 before 18.8.2

Discovery Timeline

• 2026-01-21 - GitLab releases security patch (versions 18.6.4, 18.7.2, 18.8.2)
• 2026-01-22 - CVE CVE-2025-13335 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2025-13335

Vulnerability Analysis

This vulnerability is classified under CWE-835 (Loop with Unreachable Exit Condition), commonly known as an Infinite Loop vulnerability. The flaw resides in GitLab's Wiki document processing engine, which fails to properly detect and prevent cyclic references in certain document structures.

When users create or edit Wiki documents, GitLab parses the content to render it appropriately. The cycle detection mechanism is designed to prevent infinite loops when processing documents with circular references. However, an authenticated attacker can craft malformed Wiki documents that bypass this protection, causing the parser to enter an infinite loop or excessively long processing cycle.

The vulnerability requires network access and a valid GitLab user account to exploit. While it does not compromise confidentiality or integrity, it poses a significant availability risk as successful exploitation can render the GitLab instance unresponsive.

Root Cause

The root cause stems from incomplete cycle detection logic in the Wiki document parser. The existing detection mechanism fails to account for certain edge cases in document structure that can create implicit circular references. When these malformed documents are processed, the parser continues indefinitely without recognizing the cyclic condition, consuming server resources until the service becomes unavailable.

Attack Vector

The attack is network-accessible and requires low-privilege authentication. An attacker with any valid GitLab user account can exploit this vulnerability by:

1. Navigating to any project Wiki they have write access to
2. Creating a new Wiki page or editing an existing one
3. Inserting specially crafted content that creates a cyclic structure bypassing detection
4. Saving the document, triggering the parser and initiating resource exhaustion

The exploitation does not require user interaction beyond the attacker's own actions, and the attack complexity is low. Since the vulnerability affects availability only, there is no data exfiltration or modification capability. For technical details on the specific document structures that trigger this condition, refer to the GitLab Issue #581060 and HackerOne Report #3418023.

Detection Methods for CVE-2025-13335

Indicators of Compromise

• Unusual CPU or memory spikes correlated with Wiki page access or edits
• GitLab application logs showing prolonged request processing for Wiki-related endpoints
• Timeout errors reported by users when accessing Wiki pages
• Service worker processes consuming excessive resources without completing tasks

Detection Strategies

• Monitor GitLab application performance metrics for anomalous resource consumption patterns
• Implement request timeout thresholds for Wiki document rendering operations
• Review audit logs for unusual Wiki editing activity from specific user accounts
• Deploy application-level monitoring to detect infinite loop conditions in document processing

Monitoring Recommendations

• Configure alerting for GitLab worker process CPU utilization exceeding normal baselines
• Implement log analysis rules to detect repeated Wiki processing failures or timeouts
• Monitor request duration metrics for Wiki-related API endpoints
• Establish baseline metrics for Wiki document processing times to identify anomalies

How to Mitigate CVE-2025-13335

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.6.4, 18.7.2, or 18.8.2 immediately
• Audit recent Wiki document changes for suspicious content patterns
• Consider temporarily restricting Wiki edit permissions to trusted users until patching is complete
• Implement resource limits for Wiki processing workers if available in your deployment

Patch Information

GitLab has released security patches addressing this vulnerability. Organizations should upgrade to the following patched versions based on their current release branch:

• Version 18.6.4 - For organizations on the 18.6.x release branch
• Version 18.7.2 - For organizations on the 18.7.x release branch
• Version 18.8.2 - For organizations on the 18.8.x release branch

Detailed patch information and upgrade instructions are available in the GitLab Patch Release Notes.

Workarounds

• Restrict Wiki creation and editing permissions to essential personnel only
• Implement Web Application Firewall (WAF) rules to inspect and limit Wiki document payload sizes
• Configure process-level resource limits (CPU/memory) for GitLab worker processes
• Enable request timeout enforcement at the load balancer or reverse proxy level

# Configuration example - Implementing timeout limits in nginx reverse proxy
# Add to GitLab nginx configuration

# Set proxy timeout limits for Wiki endpoints
location ~ ^/.*/-/wikis {
    proxy_connect_timeout 30s;
    proxy_read_timeout 60s;
    proxy_send_timeout 30s;
    client_max_body_size 10m;
}