CVE-2025-3111: GitLab Kubernetes Integration DoS Vulnerability

CVE-2025-3111 Overview

CVE-2025-3111 is a denial of service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw exists in the Kubernetes integration component and stems from missing input validation. An authenticated user can send crafted input that triggers resource exhaustion, degrading availability of the GitLab instance.

The issue affects all versions from 10.2 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. GitLab has classified the weakness under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
An authenticated attacker with low privileges can cause denial of service against GitLab CE/EE instances through the Kubernetes integration, impacting availability for all users of the platform.

Affected Products

GitLab CE/EE versions 10.2 through 17.10.6
GitLab CE/EE versions 17.11 through 17.11.2
GitLab CE/EE version 18.0.0

Discovery Timeline

2025-05-22 - CVE-2025-3111 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3111

Vulnerability Analysis

The vulnerability resides in GitLab's Kubernetes integration feature. This component allows users to connect Kubernetes clusters to GitLab projects and groups for deployment automation. The integration exposes endpoints that accept user-supplied input, which is then processed by backend services.

Because the integration lacks proper input validation, an authenticated user can supply malformed or oversized input. The backend processes this input without enforcing resource limits, leading to denial of service against the GitLab application. Impact is confined to availability; the vulnerability does not compromise confidentiality or integrity.

Further technical context is available in GitLab Issue #533313 and HackerOne Report #3045424.

Root Cause

The root cause is missing input validation combined with the absence of resource throttling, classified as CWE-770. The Kubernetes integration accepts input without validating size, structure, or resource cost before processing. This allows a low-privileged authenticated user to trigger disproportionate resource consumption on the GitLab server.

Attack Vector

The attack vector is network-based and requires an authenticated account with low privileges. No user interaction is required. An attacker with any authenticated GitLab account that can access the Kubernetes integration endpoints can trigger the condition. Because GitLab instances often support open registration or serve large developer populations, the practical barrier to exploitation is low.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-3111

Indicators of Compromise

Unexplained spikes in CPU, memory, or worker process consumption on GitLab application or Sidekiq nodes.
HTTP 5xx errors or request timeouts originating from Kubernetes integration API endpoints.
Repeated requests from a single authenticated user targeting Kubernetes integration paths within a short time window.
Sidekiq job queue backlogs or worker restarts correlating with Kubernetes integration activity.

Detection Strategies

Review GitLab production logs (production_json.log, api_json.log) for anomalous request patterns to Kubernetes integration endpoints.
Correlate authenticated user IDs with resource utilization spikes on GitLab web and worker nodes.
Alert on repeated failed or long-running requests tied to Kubernetes cluster management APIs.

Monitoring Recommendations

Track request rate and payload size metrics for Kubernetes integration endpoints per user.
Baseline normal Sidekiq worker execution times and alert on sustained deviations.
Enable Prometheus metrics for GitLab and monitor puma_active_connections and worker saturation.

How to Mitigate CVE-2025-3111

Immediate Actions Required

Upgrade GitLab CE/EE to version 17.10.7, 17.11.3, 18.0.1, or later without delay.
Audit GitLab user accounts and remove inactive or unnecessary accounts to reduce the authenticated attack surface.
Review who has access to Kubernetes integration features across projects and groups.
Restrict new user registration to trusted domains where operationally feasible.

Patch Information

GitLab has released fixed versions 17.10.7, 17.11.3, and 18.0.1. Administrators running self-managed GitLab instances should upgrade using the standard package manager or Omnibus upgrade procedure. GitLab.com SaaS is already patched by GitLab. Consult GitLab Issue #533313 for release-specific details.

Workarounds

If immediate patching is not possible, disable the Kubernetes integration at the project and group level until upgrade can be completed.
Apply rate limiting at a reverse proxy or web application firewall for requests targeting Kubernetes integration API paths.
Monitor and restrict low-privileged user creation of new Kubernetes cluster integrations.

bash

# Example: Upgrade GitLab Omnibus on Debian/Ubuntu to a patched release
sudo apt-get update
sudo apt-get install gitlab-ee=18.0.1-ee.0
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart

# Verify version after upgrade
sudo gitlab-rake gitlab:env:info | grep Version