CVE-2025-14869: GitLab CE/EE DoS Vulnerability

CVE-2025-14869 Overview

CVE-2025-14869 is a denial of service vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw allows an unauthenticated remote attacker to disrupt service availability by sending specially crafted payloads to certain API endpoints. GitLab tracks this issue under Improper Handling of Length Parameter Inconsistency [CWE-1284], a class of input validation weaknesses. The vulnerability affects all GitLab CE/EE versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. GitLab released patched versions on May 13, 2026 to address the issue.

Critical Impact

An unauthenticated attacker can trigger denial of service on GitLab instances by sending crafted payloads to vulnerable API endpoints, disrupting source code management and CI/CD operations.

Affected Products

• GitLab CE/EE versions 18.5 through 18.9.6
• GitLab CE/EE versions 18.10 through 18.10.5
• GitLab CE/EE versions 18.11 through 18.11.2

Discovery Timeline

• 2026-05-13 - GitLab releases patched versions 18.9.7, 18.10.6, and 18.11.3
• 2026-05-14 - CVE-2025-14869 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2025-14869

Vulnerability Analysis

The vulnerability is a denial of service condition triggered through unauthenticated requests to specific GitLab API endpoints. An attacker can send malformed or oversized payloads that cause the GitLab application to consume excessive resources or fail to process input correctly. The flaw is exploitable over the network without authentication or user interaction, and impacts only availability — confidentiality and integrity remain intact. Because GitLab is commonly deployed as a central source code management and CI/CD platform, an availability outage disrupts development pipelines, deployments, and developer productivity.

Root Cause

The issue is classified under [CWE-1284] (Improper Validation of Specified Quantity in Input). The affected API endpoints fail to properly validate length or quantity parameters in incoming payloads. When the application processes input that does not match expected size constraints, it triggers resource exhaustion or unhandled processing conditions that halt request handling.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker sends specially crafted HTTP requests to vulnerable API endpoints exposed by the GitLab instance. Because the requests do not require valid credentials, any internet-exposed GitLab deployment is reachable by external actors. Repeated requests can sustain the denial of service condition. Technical details of the specific endpoints and payload structure are restricted under GitLab's coordinated disclosure practice; see the HackerOne Security Report #3447146 and GitLab Work Item #584489 for vendor-published details.

Detection Methods for CVE-2025-14869

Indicators of Compromise

• Unexplained spikes in CPU, memory, or worker process utilization on GitLab application nodes (Puma, Sidekiq, Workhorse)
• HTTP 5xx error rates increasing on GitLab API endpoints with no corresponding deployment change
• Repeated unauthenticated API requests from a single source or distributed IP set with anomalous payload sizes
• GitLab service restarts or health check failures correlated with inbound API traffic patterns

Detection Strategies

• Inspect GitLab production_json.log and api_json.log for repeated unauthenticated requests with abnormal params or content-length values
• Monitor reverse proxy and load balancer logs for spikes in request rates against /api/v4/ endpoints from unauthenticated sources
• Correlate application worker timeouts and OOM-kill events with inbound request patterns

Monitoring Recommendations

• Enable rate limiting on GitLab API endpoints and alert when configured thresholds are exceeded
• Track GitLab version inventory across self-managed instances to identify hosts still running vulnerable versions
• Forward GitLab application logs, web server logs, and host telemetry to a centralized analytics platform for anomaly identification

How to Mitigate CVE-2025-14869

Immediate Actions Required

• Upgrade GitLab CE/EE to version 18.9.7, 18.10.6, or 18.11.3 or later, matching your installed release branch
• Audit GitLab instance exposure and restrict API endpoint access to trusted networks where feasible
• Review web application firewall and reverse proxy configurations to enforce request size and rate limits

Patch Information

GitLab published patched releases on May 13, 2026. Self-managed administrators should upgrade to GitLab 18.9.7, 18.10.6, or 18.11.3 per the GitLab Patch Release Announcement. GitLab.com is already running the patched version and requires no customer action.

Workarounds

• Place GitLab behind a web application firewall with strict request validation and rate limiting on /api/v4/ paths
• Restrict network access to the GitLab instance using firewall rules or VPN-only access until patching is complete
• Enable and tune GitLab's built-in application rate limits to throttle anonymous API traffic

# Verify installed GitLab version (Omnibus install)
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Upgrade GitLab Omnibus on Debian/Ubuntu
sudo apt update
sudo apt install gitlab-ee=18.11.3-ee.0

# Upgrade GitLab Omnibus on RHEL/CentOS
sudo yum install gitlab-ee-18.11.3-ee.0

# Reconfigure and restart
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart