CVE-2025-13690: GitLab CE/EE DOS Vulnerability

CVE-2025-13690 Overview

CVE-2025-13690 is a denial of service vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability exists due to improper input validation on webhook custom header names, allowing an authenticated user to cause a denial of service condition under certain conditions. This issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).

Critical Impact

Authenticated attackers can exploit improper webhook header validation to trigger a denial of service, potentially disrupting CI/CD pipelines, project integrations, and critical development workflows across affected GitLab instances.

Affected Products

• GitLab CE/EE versions 16.11 through 18.7.5 (fixed in 18.7.6)
• GitLab CE/EE versions 18.8.0 through 18.8.5 (fixed in 18.8.6)
• GitLab CE/EE versions 18.9.0 through 18.9.1 (fixed in 18.9.2)

Discovery Timeline

• 2026-03-11 - CVE-2025-13690 published to NVD
• 2026-03-11 - GitLab releases security patch (versions 18.7.6, 18.8.6, 18.9.2)
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2025-13690

Vulnerability Analysis

This vulnerability stems from improper input validation in GitLab's webhook functionality, specifically in the handling of custom header names. When users configure webhooks for project integrations, GitLab fails to adequately validate or limit the custom header name inputs, creating conditions where resource allocation can be abused.

The vulnerability allows authenticated users to craft malicious webhook configurations that, when processed, consume excessive system resources. This resource exhaustion can lead to service degradation or complete denial of service for the affected GitLab instance.

The network-based attack vector combined with low attack complexity makes this vulnerability particularly concerning for organizations relying on GitLab for their software development lifecycle. While authentication is required (limiting exposure to trusted users or compromised accounts), the potential for availability impact is significant.

Root Cause

The root cause is CWE-770: Allocation of Resources Without Limits or Throttling. GitLab's webhook processing code does not implement adequate bounds checking or resource limits when handling custom header names. This allows attackers to supply inputs that trigger excessive resource consumption, whether through memory allocation, CPU processing cycles, or other system resources.

Attack Vector

The attack is executed over the network by an authenticated user with permissions to configure webhooks. The attacker crafts a webhook configuration with specially constructed custom header names that exploit the lack of input validation. When GitLab processes these headers, the improper validation leads to resource exhaustion, causing service disruption.

The attack requires:

1. Valid authentication to a GitLab instance
2. Permissions to create or modify webhook configurations
3. Knowledge of the vulnerable header name processing behavior

No user interaction is required beyond the initial authentication, and the attack does not affect confidentiality or integrity—only availability is impacted.

Detection Methods for CVE-2025-13690

Indicators of Compromise

• Unusual webhook configurations with abnormally long or malformed custom header names
• Elevated memory or CPU usage on GitLab application servers coinciding with webhook operations
• Repeated webhook configuration changes from specific user accounts
• Service degradation or timeouts during webhook processing events

Detection Strategies

• Monitor GitLab audit logs for suspicious webhook creation or modification activities
• Implement alerting on resource utilization spikes correlated with webhook processing
• Review webhook configurations across projects for anomalous custom header patterns
• Deploy application performance monitoring to detect processing delays in webhook handlers

Monitoring Recommendations

• Enable detailed logging for webhook operations in GitLab configuration
• Set up resource utilization thresholds and alerts for GitLab application servers
• Implement rate limiting on webhook configuration API endpoints where possible
• Regularly audit webhook configurations across all projects and groups

How to Mitigate CVE-2025-13690

Immediate Actions Required

• Upgrade GitLab CE/EE to patched versions: 18.7.6, 18.8.6, or 18.9.2 immediately
• Review existing webhook configurations for any suspicious or unusual custom headers
• Audit user accounts with webhook configuration permissions for unauthorized access
• Monitor GitLab server resource utilization for signs of ongoing exploitation

Patch Information

GitLab has released patched versions addressing this vulnerability. Organizations should upgrade to the following versions based on their current deployment:

For detailed patch information, refer to the GitLab Patch Release Announcement. Additional technical details are available in GitLab Work Item #582096 and the original HackerOne Report #3415683.

Workarounds

• Restrict webhook configuration permissions to trusted administrators only
• Implement network-level rate limiting for GitLab API endpoints related to webhooks
• Consider temporarily disabling custom webhook headers if the feature is not business-critical
• Deploy monitoring and alerting to detect and respond to denial of service attempts quickly