CVE-2025-14511: GitLab Container Registry DoS Vulnerability

CVE-2025-14511 Overview

A denial of service vulnerability has been identified in GitLab CE/EE that allows an unauthenticated attacker to disrupt service availability by sending specially crafted files to the container registry event endpoint. This vulnerability affects GitLab instances running versions from 12.2 through the latest releases prior to the security patches, potentially impacting organizations relying on GitLab's container registry functionality for their DevOps workflows.

Critical Impact

Unauthenticated attackers can cause denial of service conditions on GitLab instances by exploiting improper input validation in the container registry event endpoint, potentially disrupting CI/CD pipelines and development operations.

Affected Products

• GitLab CE/EE versions 12.2 before 18.7.5
• GitLab CE/EE versions 18.8 before 18.8.5
• GitLab CE/EE versions 18.9 before 18.9.1

Discovery Timeline

• 2026-02-25 - CVE-2025-14511 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2025-14511

Vulnerability Analysis

This vulnerability is classified under CWE-1284 (Improper Validation of Specified Quantity in Input), indicating that the GitLab container registry event endpoint fails to properly validate the size, length, or quantity of input data before processing. The flaw allows unauthenticated users to submit maliciously crafted files that can exhaust server resources or trigger unexpected behavior in the container registry processing logic.

The attack exploits weaknesses in how the container registry event handler processes incoming data, specifically when handling certain file structures or payloads under specific conditions. This improper input validation can lead to resource exhaustion, causing the GitLab instance to become unresponsive.

Root Cause

The root cause of this vulnerability lies in improper validation of specified quantity in input (CWE-1284) within the container registry event endpoint. The application fails to adequately validate or limit the quantity, size, or structure of data being processed from incoming requests. When specially crafted files are submitted to this endpoint, the lack of proper boundary checking or resource limits allows an attacker to trigger conditions that consume excessive server resources, leading to denial of service.

Attack Vector

The attack can be executed remotely over the network without requiring authentication. An attacker crafts malicious files specifically designed to exploit the input validation weakness in the container registry event endpoint. When these files are submitted to the vulnerable endpoint under certain conditions, they trigger resource exhaustion or processing failures that render the GitLab service unavailable.

The vulnerability requires no user interaction and can be exploited with low attack complexity, making it particularly dangerous for internet-facing GitLab instances. The attack specifically targets the availability of the system without impacting confidentiality or integrity of data.

Detection Methods for CVE-2025-14511

Indicators of Compromise

• Unusual spikes in requests to the container registry event endpoint (/v2/ or related container registry API paths)
• Abnormal resource consumption (CPU, memory) associated with container registry processes
• Multiple requests from single or distributed IP addresses targeting registry endpoints with malformed or oversized payloads
• GitLab service degradation or unresponsiveness following suspicious registry activity

Detection Strategies

• Implement rate limiting and request throttling on container registry endpoints to detect and block abnormal request volumes
• Monitor GitLab application logs for errors related to container registry event processing, particularly timeout or resource exhaustion errors
• Deploy web application firewall (WAF) rules to inspect and filter malformed requests targeting container registry endpoints
• Configure alerting for unusual patterns in registry API traffic, including large payload sizes or malformed file submissions

Monitoring Recommendations

• Enable detailed logging for container registry event endpoints and monitor for processing anomalies
• Set up resource utilization alerts for GitLab server components, particularly those handling registry operations
• Implement network traffic analysis to identify potential DoS attack patterns targeting the container registry
• Monitor for service availability issues and correlate with registry endpoint activity

How to Mitigate CVE-2025-14511

Immediate Actions Required

• Upgrade GitLab CE/EE to patched versions: 18.7.5, 18.8.5, or 18.9.1 depending on your current version branch
• If immediate patching is not possible, implement network-level restrictions to limit access to container registry endpoints
• Review and harden rate limiting configurations for registry-related API endpoints
• Monitor system resources closely for signs of exploitation attempts

Patch Information

GitLab has released security patches addressing this vulnerability. Organizations should upgrade to the following versions immediately:

• Version 18.7.5 - For installations on the 18.7.x branch
• Version 18.8.5 - For installations on the 18.8.x branch
• Version 18.9.1 - For installations on the 18.9.x branch

For detailed patch information and upgrade instructions, refer to the GitLab Patch Release Notes. Additional technical details about the vulnerability can be found in the GitLab Issue Discussion and the HackerOne Report #3452200.

Workarounds

• Implement strict network access controls to limit which IP addresses or networks can access container registry endpoints
• Deploy a reverse proxy or WAF in front of GitLab with rules to filter potentially malicious payloads targeting registry endpoints
• If the container registry feature is not required, consider disabling it temporarily until patches can be applied
• Configure resource limits and request timeouts for registry processing to minimize the impact of exploitation attempts

# Example: Restrict container registry access via NGINX (if using NGINX as reverse proxy)
# Add to your NGINX configuration for GitLab
location ~ ^/v2/ {
    # Limit request rate to registry endpoints
    limit_req zone=registry_limit burst=10 nodelay;
    
    # Restrict access to trusted networks only
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    # Limit request body size
    client_max_body_size 100M;
    
    proxy_pass http://gitlab-workhorse;
}