CVE-2025-14871: GitLab GraphQL DoS Vulnerability

CVE-2025-14871 Overview

CVE-2025-14871 is a denial of service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw resides in the GraphQL complexity calculation logic and stems from improper resource allocation limits [CWE-770]. Under certain conditions, an unauthenticated attacker can send crafted GraphQL requests over the network to exhaust server resources. The issue affects GitLab CE/EE versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. GitLab remediated the vulnerability in patch release 19.3.2 and the corresponding backports.

Critical Impact
Unauthenticated attackers can trigger denial of service against GitLab instances by exploiting the GraphQL complexity calculation, disrupting availability of source code management, CI/CD, and DevOps workflows.

Affected Products

GitLab CE/EE 18.4.6 through versions before 19.1.8
GitLab CE/EE 19.2 through versions before 19.2.6
GitLab CE/EE 19.3 through versions before 19.3.2

Discovery Timeline

2026-09-16 - CVE-2025-14871 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2025-14871

Vulnerability Analysis

GitLab exposes a GraphQL API for programmatic access to projects, issues, pipelines, and other DevOps resources. The API applies a complexity calculation to reject overly expensive queries before executing them. CVE-2025-14871 exists because the complexity calculation logic does not enforce sufficient resource allocation limits under specific query shapes. An attacker can construct GraphQL requests that either bypass or under-account for the true execution cost. Processing those requests consumes disproportionate CPU, memory, or database resources on the GitLab backend. Because the API endpoint is reachable without authentication in certain configurations, the attack requires no credentials and no user interaction.

Root Cause

The root cause is improper enforcement of resource allocation limits [CWE-770] in the GraphQL query complexity analyzer. The analyzer fails to correctly bound the estimated cost of specific query structures. Requests that appear cheap to the complexity check translate into expensive operations at execution time. This mismatch allows a single request, or a small number of requests, to degrade service availability.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends crafted GraphQL queries to the exposed /api/graphql endpoint of a vulnerable GitLab instance. Repeated or sufficiently complex requests exhaust worker processes, memory, or database connections, causing denial of service for legitimate users. No verified public proof-of-concept exploit code is available at this time. Refer to the GitLab Patch Release 19.3.2 advisory and HackerOne Report #3462311 for further technical context.

Detection Methods for CVE-2025-14871

Indicators of Compromise

Sustained spikes in CPU, memory, or database load on GitLab application servers without a corresponding increase in user activity.
Unauthenticated POST requests to /api/graphql from a small set of source addresses with abnormally large or deeply nested query payloads.
Elevated 5xx error rates, Puma or Sidekiq worker timeouts, and slow response times in GitLab production logs.

Detection Strategies

Parse GitLab production_json.log for GraphQL operations with high duration_s or db_duration_s values originating from unauthenticated sessions.
Monitor the ratio of GraphQL request volume to authenticated user sessions and alert on outliers.
Correlate reverse proxy or load balancer logs with backend health metrics to identify request bursts preceding availability degradation.

Monitoring Recommendations

Enable rate limiting and request-size limits at the reverse proxy in front of GitLab and forward the logs to a central analytics platform.
Track GraphQL endpoint latency, error rate, and worker saturation as first-class service health metrics.
Ingest GitLab application and infrastructure logs into a security data lake to support historical hunting for repeated complexity-abuse patterns.

How to Mitigate CVE-2025-14871

Immediate Actions Required

Upgrade GitLab CE/EE to 19.3.2, 19.2.6, or 19.1.8 depending on the current major version.
Inventory all self-managed GitLab instances, including internal and disaster recovery nodes, and confirm patch status.
Restrict network exposure of the GitLab web interface and /api/graphql endpoint to trusted networks where feasible.

Patch Information

GitLab addressed CVE-2025-14871 in the GitLab Patch Release 19.3.2, with backports to 19.2.6 and 19.1.8. GitLab.com is managed by GitLab and does not require customer action. Self-managed administrators should apply the patched version that matches their release train. Additional tracking is available in GitLab Work Item #584492.

Workarounds

Apply strict rate limits to the /api/graphql endpoint using GitLab's built-in application rate limits or an upstream reverse proxy.
Require authentication for GraphQL access where the deployment model allows, reducing the unauthenticated attack surface.
Deploy a web application firewall rule to block GraphQL requests exceeding a defined query depth, size, or field count.

bash

# Example NGINX rate limit for the GitLab GraphQL endpoint
limit_req_zone $binary_remote_addr zone=graphql_zone:10m rate=10r/m;

server {
    location = /api/graphql {
        limit_req zone=graphql_zone burst=5 nodelay;
        client_max_body_size 100k;
        proxy_pass http://gitlab_upstream;
    }
}