CVE-2025-3601: GitLab DoS Vulnerability via Large Responses

CVE-2025-3601 Overview

CVE-2025-3601 is a Denial of Service (DoS) vulnerability affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 8.15 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1. An authenticated user can trigger the condition by submitting URLs that generate excessively large responses, exhausting server resources. The issue is categorized under [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
An authenticated attacker can degrade or interrupt GitLab service availability by submitting URLs that cause the server to process and buffer excessively large HTTP responses.

Affected Products

GitLab Community Edition (CE) versions 8.15 through 18.1.5
GitLab Enterprise Edition (EE) versions 18.2 through 18.2.5
GitLab CE/EE versions 18.3 through 18.3.1

Discovery Timeline

2025-08-27 - CVE-2025-3601 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3601

Vulnerability Analysis

The vulnerability resides in GitLab functionality that fetches remote content based on user-supplied URLs. When an authenticated user submits a URL that responds with an excessively large payload, GitLab processes the response without enforcing sufficient size limits. This unbounded resource consumption exhausts memory, CPU, or network bandwidth on the GitLab instance.

An attacker only needs a valid low-privilege account to abuse the endpoint. Repeated requests amplify the impact, degrading responsiveness for other users and potentially causing the instance to become unavailable. The flaw affects both self-managed and Enterprise deployments across a wide version range spanning multiple major releases.

Root Cause

The root cause is missing enforcement of response size limits when GitLab retrieves remote resources referenced by user-controlled URLs. Under [CWE-770], the application allocates memory and processing capacity proportional to the attacker-controlled response, without imposing an upper bound or throttling mechanism to protect availability.

Attack Vector

Exploitation requires network access to the GitLab instance and an authenticated user session with low privileges. The attacker submits a URL pointing to a server they control, which returns an unbounded or very large response body. GitLab attempts to fully consume the response, tying up resources. See the GitLab Issue Report and the HackerOne Vulnerability Report for additional technical context. No verified proof-of-concept code is publicly available at this time.

Detection Methods for CVE-2025-3601

Indicators of Compromise

Sustained spikes in memory or CPU utilization on GitLab application (Puma/Sidekiq) workers correlated with outbound HTTP requests to attacker-controlled hosts.
Repeated outbound requests from GitLab to unusual external URLs returning large or streaming response bodies.
Increased 5xx responses, request timeouts, or worker restarts in GitLab application logs.

Detection Strategies

Review GitLab production logs (production.log, application.log) for endpoints that accept user-supplied URLs followed by resource-intensive processing.
Monitor egress network flows from GitLab servers for large inbound transfers originating from user-triggered fetch operations.
Correlate authenticated user session activity with abnormal worker resource consumption to identify potential abuse patterns.

Monitoring Recommendations

Instrument alerts for GitLab worker memory growth above baseline thresholds and abnormal garbage collection activity.
Track per-user request rates to URL-fetching endpoints and flag accounts generating disproportionate outbound traffic.
Forward GitLab and reverse-proxy logs to a centralized analytics platform to enable behavioral baselining across the environment.

How to Mitigate CVE-2025-3601

Immediate Actions Required

Upgrade GitLab CE/EE to version 18.1.5, 18.2.5, or 18.3.1 (or later) depending on the deployed release branch.
Audit recent authenticated user activity for abnormal use of URL-fetch features and revoke suspicious tokens or sessions.
Restrict outbound network access from GitLab servers to only required destinations to limit attacker-controlled fetch targets.

Patch Information

GitLab has released fixed versions 18.1.5, 18.2.5, and 18.3.1 that address CVE-2025-3601. Administrators of self-managed GitLab CE/EE instances should apply the appropriate patched release as documented in the GitLab Issue Report. GitLab.com SaaS instances are maintained by GitLab and receive fixes centrally.

Workarounds

Restrict GitLab outbound requests through a proxy that enforces response size limits and denies streaming or excessively large downloads.
Apply network egress allowlists so GitLab can only reach approved internal or trusted external endpoints.
Reduce exposure by limiting account creation and enforcing least-privilege roles until patches can be applied.

bash

# Example: upgrade an Omnibus GitLab package to a patched release
# Debian/Ubuntu
sudo apt-get update
sudo apt-get install gitlab-ee=18.3.1-ee.0

# RHEL/CentOS
sudo yum install gitlab-ee-18.3.1-ee.0

# Verify the running version after upgrade
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5