CVE-2025-2256: GitLab SAML DoS Vulnerability

CVE-2025-2256 Overview

CVE-2025-2256 is a denial of service vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw allows unauthorized attackers to render GitLab instances unresponsive by submitting multiple concurrent large Security Assertion Markup Language (SAML) responses. The issue impacts all GitLab versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2. The vulnerability is tracked under [CWE-1284] (Improper Validation of Specified Quantity in Input) and carries a CVSS score of 7.5.

Critical Impact
Unauthenticated attackers can exhaust GitLab server resources by sending oversized SAML responses concurrently, blocking legitimate user access.

Affected Products

GitLab CE/EE versions 7.12 through 18.1.5
GitLab CE/EE versions 18.2.0 through 18.2.5
GitLab CE/EE versions 18.3.0 through 18.3.1

Discovery Timeline

2025-09-10 - GitLab releases patch versions 18.3.2, 18.2.6, and 18.1.6
2025-09-12 - CVE-2025-2256 published to the National Vulnerability Database
2025-09-20 - Last updated in NVD database

Technical Details for CVE-2025-2256

Vulnerability Analysis

The vulnerability resides in GitLab's SAML authentication processing logic. SAML is an XML-based open standard used for exchanging authentication and authorization data between identity providers and service providers. GitLab's implementation accepts SAML responses without enforcing adequate quantity or size constraints on incoming payloads.

Attackers exploit this gap by submitting multiple concurrent large SAML responses to the authentication endpoint. The server attempts to parse and process each oversized payload simultaneously, consuming significant CPU and memory resources. As resources deplete, the GitLab instance becomes unresponsive to legitimate authentication and application requests.

The flaw does not require authentication or user interaction. It impacts availability only, with no compromise to confidentiality or integrity of stored data.

Root Cause

The root cause is improper validation of specified quantity in input [CWE-1284]. GitLab's SAML handling code lacks sufficient limits on SAML response size and concurrent request volume. Without these controls, the application processes attacker-controlled payloads of arbitrary size until resources are exhausted.

Attack Vector

The attack vector is network-based and requires no privileges. An attacker sends concurrent HTTP POST requests carrying large SAML response payloads to the GitLab SAML authentication endpoint. The server processes each payload in parallel, leading to resource exhaustion and denial of service for authenticated users and administrative operations.

No public proof-of-concept has been released. Technical details are referenced in the GitLab Issue Discussion and the HackerOne Vulnerability Report.

Detection Methods for CVE-2025-2256

Indicators of Compromise

Spikes in CPU and memory utilization on GitLab application nodes coinciding with SAML authentication traffic
Multiple concurrent HTTP POST requests to SAML authentication endpoints (/users/auth/saml/callback) carrying unusually large request bodies
Sustained 5xx HTTP error responses or timeouts from GitLab web frontends during SAML processing
Worker process restarts or out-of-memory conditions in Puma or Sidekiq logs

Detection Strategies

Monitor request body sizes for SAML callback endpoints and alert on anomalous payload volumes
Correlate authentication endpoint traffic patterns against baseline SAML usage from your identity provider
Track GitLab Workhorse and Rails application logs for parser errors and SAML processing exceptions

Monitoring Recommendations

Enable detailed access logging on GitLab reverse proxies or load balancers for the SAML callback path
Deploy resource utilization alerts on GitLab application nodes to identify exhaustion conditions early
Forward GitLab production logs to a centralized log management or SIEM platform for correlation and historical analysis

How to Mitigate CVE-2025-2256

Immediate Actions Required

Upgrade GitLab CE/EE to version 18.3.2, 18.2.6, or 18.1.6 as documented in the GitLab Patch Release Announcement
Restrict access to GitLab SAML endpoints at the network perimeter where feasible
Review GitLab application logs for prior anomalous SAML traffic patterns

Patch Information

GitLab released fixed versions 18.3.2, 18.2.6, and 18.1.6 on September 10, 2025. The patches enforce constraints on SAML response handling to prevent resource exhaustion. Administrators should consult the GitLab Patch Release Announcement for upgrade instructions.

Workarounds

Configure a reverse proxy (NGINX, HAProxy) to enforce maximum request body size limits on SAML callback paths
Apply rate limiting on the SAML authentication endpoint to cap concurrent requests per source IP
Disable SAML authentication temporarily if the integration is not in active use until patching is complete

bash

# Example NGINX configuration to limit SAML request body size and rate
http {
    limit_req_zone $binary_remote_addr zone=saml_limit:10m rate=5r/s;

    server {
        location /users/auth/saml/callback {
            client_max_body_size 256k;
            limit_req zone=saml_limit burst=10 nodelay;
            proxy_pass http://gitlab_backend;
        }
    }
}