CVE-2025-13929: GitLab CE/EE DoS Vulnerability

CVE-2025-13929 Overview

CVE-2025-13929 is a Denial of Service vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). This vulnerability allows an unauthenticated attacker to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certain conditions. The flaw stems from improper resource allocation without limits (CWE-770), enabling attackers to exhaust server resources remotely without requiring any authentication.

Critical Impact

Unauthenticated attackers can disrupt GitLab services by targeting repository archive endpoints with malicious requests, potentially causing widespread service unavailability for development teams relying on GitLab infrastructure.

Affected Products

• GitLab CE/EE versions from 10.0 before 18.7.6
• GitLab CE/EE versions 18.8 before 18.8.6
• GitLab CE/EE versions 18.9 before 18.9.2

Discovery Timeline

• 2026-03-11 - GitLab releases security patch (version 18.9.2)
• 2026-03-11 - CVE-2025-13929 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2025-13929

Vulnerability Analysis

This vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling. The flaw exists in the repository archive endpoint functionality within GitLab CE/EE. When processing archive requests, the application fails to properly limit resource allocation, allowing an attacker to craft requests that consume excessive server resources.

The attack can be executed over the network without requiring authentication, making it particularly dangerous for publicly accessible GitLab instances. The vulnerability specifically impacts availability without affecting confidentiality or integrity of data stored in the system.

Root Cause

The root cause of CVE-2025-13929 lies in the improper handling of resource allocation when processing repository archive requests. The repository archive endpoint does not implement adequate rate limiting or resource constraints, allowing malicious actors to send specially crafted requests that trigger excessive resource consumption.

This type of resource exhaustion vulnerability typically occurs when input validation and resource management controls are insufficient, enabling attackers to manipulate request parameters in ways that amplify server-side processing requirements.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can target the repository archive endpoints of a GitLab instance by sending specially crafted HTTP requests. Under certain conditions, these requests cause the server to allocate excessive resources, leading to service degradation or complete unavailability.

The attack surface includes any GitLab CE/EE instance with publicly accessible repository archive functionality. Organizations exposing GitLab to the internet without proper network-level protections are at heightened risk.

Detection Methods for CVE-2025-13929

Indicators of Compromise

• Unusual spike in requests to repository archive endpoints (/archive/ paths)
• Elevated server resource utilization (CPU, memory) without corresponding legitimate user activity
• Multiple rapid requests from single IP addresses targeting archive functionality
• HTTP 503 Service Unavailable errors or timeout responses from GitLab instances

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block anomalous archive endpoint request patterns
• Configure log analysis to alert on unusual request volumes to repository archive paths
• Deploy network-based intrusion detection signatures for GitLab archive endpoint abuse
• Monitor GitLab application logs for repeated archive requests with unusual parameters

Monitoring Recommendations

• Enable detailed access logging for GitLab web servers and monitor for request anomalies
• Set up alerting thresholds for server resource utilization metrics
• Implement rate limiting monitoring to track requests approaching or exceeding defined limits
• Regularly review GitLab security logs for signs of exploitation attempts

How to Mitigate CVE-2025-13929

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.7.6, 18.8.6, or 18.9.2 depending on your current release track
• Implement network-level rate limiting for archive endpoints if immediate patching is not possible
• Review access logs for evidence of prior exploitation attempts
• Consider temporarily restricting access to repository archive endpoints for unauthenticated users

Patch Information

GitLab has released security patches addressing this vulnerability in version 18.9.2 (and backported to 18.7.6 and 18.8.6). Organizations should upgrade to the patched versions immediately. For detailed patch information, refer to the GitLab Patch Release 18.9.2 announcement. Additional technical details are available in GitLab Issue #582738 and the associated HackerOne Report #3441004.

Workarounds

• Deploy a reverse proxy or WAF with rate limiting rules for repository archive endpoints
• Restrict network access to GitLab instances to trusted IP ranges where feasible
• Disable anonymous access to repository archives if not required for business operations
• Implement connection limits at the load balancer or firewall level to prevent resource exhaustion

# Example nginx rate limiting configuration for GitLab archive endpoints
# Add to nginx configuration
limit_req_zone $binary_remote_addr zone=archive_limit:10m rate=10r/s;

location ~ ^/.*/-/archive/ {
    limit_req zone=archive_limit burst=20 nodelay;
    proxy_pass http://gitlab-workhorse;
}