CVE-2025-14513: GitLab Protected Branches API DoS Flaw

CVE-2025-14513 Overview

CVE-2025-14513 affects GitLab Community Edition (CE) and Enterprise Edition (EE) across multiple release branches. The vulnerability resides in the protected branches Application Programming Interface (API), where improper input validation allows specially crafted JavaScript Object Notation (JSON) payloads to trigger a denial of service condition. An unauthenticated remote attacker can exploit this flaw without user interaction.

GitLab released patched versions 18.7.6, 18.8.6, and 18.9.2 to remediate the issue. The vulnerability is classified under [CWE-1284] (Improper Validation of Specified Quantity in Input).

Critical Impact
Unauthenticated attackers can disrupt GitLab availability by sending malformed JSON payloads to the protected branches API endpoint, impacting source code management workflows for DevOps teams.

Affected Products

GitLab CE/EE versions 16.11 through 18.7.5
GitLab CE/EE versions 18.8 through 18.8.5
GitLab CE/EE versions 18.9 through 18.9.1

Discovery Timeline

2026-03-11 - GitLab releases patch versions 18.7.6, 18.8.6, and 18.9.2
2026-03-11 - CVE-2025-14513 published to NVD
2026-03-13 - Last updated in NVD database

Technical Details for CVE-2025-14513

Vulnerability Analysis

The vulnerability resides in the protected branches API of GitLab CE/EE. The API endpoint fails to properly validate the structure or quantity of values in JSON request bodies. When a crafted payload is processed, the application consumes excessive resources or enters a state that disrupts normal service operation.

The flaw requires no authentication and no user interaction. An attacker only needs network access to the GitLab instance's web interface. Because protected branches are a core feature governing repository write access, the affected endpoint is exposed by default on virtually every GitLab deployment.

GitLab tracked the remediation through internal Work Item #583718 and a coordinated disclosure via HackerOne Report #3452477.

Root Cause

The root cause is improper input validation when the protected branches API parses incoming JSON payloads. The handler does not enforce limits on the specified quantity of input data before passing it to downstream processing, aligning with the [CWE-1284] weakness category. This allows a single request to disproportionately consume backend resources.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request containing a malicious JSON body to the protected branches API endpoint of a vulnerable GitLab instance. Repeated requests, or a single sufficiently expensive payload, render the affected service unresponsive. No credentials, tokens, or prior access are required.

The vulnerability impacts availability only. Confidentiality and integrity of repository data remain unaffected by exploitation of this specific flaw.

Detection Methods for CVE-2025-14513

Indicators of Compromise

Unusual spikes in CPU, memory, or worker thread consumption on GitLab Rails or Puma processes
Sustained 5xx HTTP responses or timeouts from /api/v4/projects/*/protected_branches endpoints
Anomalous volumes of POST or PUT requests to the protected branches API from unauthenticated sources
GitLab application logs showing repeated parser errors or oversized JSON payload entries

Detection Strategies

Inspect web access logs for requests to protected branches API paths with abnormally large Content-Length headers or deeply nested JSON structures
Correlate API request volume against authentication state to identify unauthenticated traffic patterns
Monitor GitLab Sidekiq and Puma worker health metrics for sudden saturation correlated with API traffic

Monitoring Recommendations

Enable detailed request logging on the GitLab reverse proxy and forward logs to a centralized analytics platform
Configure rate limiting and alerting thresholds for unauthenticated API requests at the proxy or Web Application Firewall (WAF) layer
Track GitLab version inventory continuously to ensure all instances meet the patched baseline

How to Mitigate CVE-2025-14513

Immediate Actions Required

Upgrade GitLab CE/EE to version 18.9.2, 18.8.6, or 18.7.6 depending on your release branch
Restrict network exposure of the GitLab API to trusted networks where operationally feasible
Apply request size limits and JSON payload depth restrictions at the reverse proxy layer

Patch Information

GitLab addressed CVE-2025-14513 in the GitLab Patch Release 18.9.2 published on March 11, 2026. Administrators running GitLab 16.11 or later should upgrade to 18.7.6, 18.8.6, or 18.9.2. Self-managed deployments should follow the standard GitLab upgrade procedure for their installation method.

Workarounds

Place GitLab behind a WAF and block requests with oversized or malformed JSON bodies targeting /api/v4/projects/*/protected_branches
Apply strict request rate limiting on unauthenticated API endpoints via NGINX or an upstream load balancer
Limit network access to the GitLab API to corporate VPN or trusted Classless Inter-Domain Routing (CIDR) ranges until patching is complete

bash

# NGINX example: limit request body size and rate for the protected branches API
limit_req_zone $binary_remote_addr zone=gitlab_api:10m rate=10r/s;

location ~ ^/api/v4/projects/.*/protected_branches {
    client_max_body_size 64k;
    limit_req zone=gitlab_api burst=20 nodelay;
    proxy_pass http://gitlab_upstream;
}