CVE-2025-13928: GitLab Denial of Service Vulnerability

CVE-2025-13928 Overview

CVE-2025-13928 is an authorization bypass vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) that enables unauthenticated denial of service. The flaw stems from incorrect authorization validation in API endpoints, classified under [CWE-863: Incorrect Authorization]. An unauthenticated remote attacker can send crafted API requests to exhaust server resources and disrupt service availability. The issue affects all GitLab versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2. GitLab addressed the vulnerability in the 18.8.2 patch release on January 21, 2026.

Critical Impact
Unauthenticated attackers can trigger a denial of service condition against GitLab instances over the network without user interaction.

Affected Products

GitLab CE/EE versions 17.7 through 18.6.3
GitLab CE/EE versions 18.7 through 18.7.1
GitLab CE/EE versions 18.8 through 18.8.1

Discovery Timeline

2026-01-21 - GitLab releases patch versions 18.6.4, 18.7.2, and 18.8.2
2026-01-22 - CVE-2025-13928 published to NVD
2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-13928

Vulnerability Analysis

The vulnerability resides in GitLab API endpoints that fail to correctly validate authorization on incoming requests. Because the authorization check is incorrectly implemented, the server processes requests from unauthenticated clients that should be rejected outright. Processing these requests consumes server resources such as CPU, memory, or database connections. Sustained or repeated requests degrade availability for legitimate users and can render the GitLab instance unresponsive.

The CWE-863 classification indicates the issue is not a missing authorization check but rather a flawed one. The affected endpoints likely perform a check that does not enforce the intended access policy, allowing requests to reach resource-intensive code paths. Confidentiality and integrity are not impacted; the attack targets availability only.

Root Cause

The root cause is incorrect authorization validation logic in one or more API endpoints. The check fails to reject unauthenticated callers before triggering server-side processing that is expensive enough to cause denial of service when invoked repeatedly or with specific parameters.

Attack Vector

Exploitation requires network access to the GitLab API and no authentication or user interaction. An attacker sends crafted requests to the vulnerable endpoint(s) from any network-reachable host. Internet-exposed GitLab instances face the highest exposure. Technical specifics of the affected endpoint are restricted in the GitLab Issue #582736 and HackerOne Report #3439441 pending broader patch adoption.

Detection Methods for CVE-2025-13928

Indicators of Compromise

Sudden spikes in unauthenticated API request volume against GitLab endpoints
Elevated CPU, memory, or database connection usage on GitLab application servers without a corresponding increase in authenticated user activity
HTTP 5xx error rates increasing on /api/v4/ routes
Repeated requests from a small number of source IP addresses targeting the same API path

Detection Strategies

Review GitLab production_json.log and api_json.log for unauthenticated requests reaching API endpoints at abnormal rates
Correlate web server access logs with application performance metrics to identify request patterns that precede degradation
Deploy rate-limit alerts in front of GitLab to flag bursts of anonymous API traffic

Monitoring Recommendations

Track GitLab instance health metrics (Puma worker saturation, Sidekiq queue depth, PostgreSQL connection count) for anomalies
Alert on sustained anonymous API traffic exceeding baseline thresholds
Forward GitLab application and reverse proxy logs to a centralized SIEM for retention and correlation

How to Mitigate CVE-2025-13928

Immediate Actions Required

Upgrade GitLab CE/EE to version 18.8.2, 18.7.2, or 18.6.4 depending on your installed branch
Inventory all self-managed GitLab instances and prioritize internet-exposed deployments for patching
Restrict GitLab API exposure to trusted networks where operationally feasible until patching is complete

Patch Information

GitLab released fixed versions 18.6.4, 18.7.2, and 18.8.2 on January 21, 2026. Upgrade instructions and release notes are available in the GitLab 18.8.2 Patch Release announcement. GitLab.com (SaaS) is already running the patched version.

Workarounds

Place GitLab behind a reverse proxy or web application firewall configured with strict rate limiting on /api/ paths
Block or throttle anonymous API traffic from untrusted source ranges at the network edge
Limit external network exposure of the GitLab API until the upgrade is applied

bash

# Example NGINX rate limit for anonymous GitLab API traffic
http {
    limit_req_zone $binary_remote_addr zone=gitlab_api:10m rate=10r/s;

    server {
        location /api/ {
            limit_req zone=gitlab_api burst=20 nodelay;
            proxy_pass http://gitlab_upstream;
        }
    }
}