CVE-2025-7337: GitLab Persistent DOS Vulnerability

CVE-2025-7337 Overview

CVE-2025-7337 is a denial of service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw allows an authenticated user with Developer-level access to cause a persistent denial of service across an entire GitLab instance by uploading large files. The issue affects all versions from 7.8 before 18.1.6, versions 18.2 before 18.2.6, and versions 18.3 before 18.3.2. The root cause maps to [CWE-770: Allocation of Resources Without Limits or Throttling]. GitLab released fixed packages in patch release 18.3.2 on September 10, 2025.

Critical Impact
An authenticated Developer-level account can exhaust storage or related resources on a GitLab instance, producing a persistent denial of service that affects all users of the instance.

Affected Products

GitLab CE/EE all versions from 7.8 before 18.1.6
GitLab CE/EE 18.2 before 18.2.6
GitLab CE/EE 18.3 before 18.3.2

Discovery Timeline

2025-09-10 - GitLab releases patch versions 18.3.2, 18.2.6, and 18.1.6
2025-09-12 - CVE-2025-7337 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2025-7337

Vulnerability Analysis

The vulnerability resides in GitLab's file upload handling path, which fails to adequately throttle or cap resources consumed by uploaded content. An authenticated user with at least Developer role on a project can submit large files that are persisted by the instance. Because the resource consumption is persistent rather than transient, a single abusive actor can degrade service availability for every user of the GitLab instance until an administrator intervenes.

The weakness is classified under [CWE-770], which covers scenarios where an application allocates finite resources, such as disk space, memory, or database rows, without enforcing bounds appropriate for the trust level of the requester. The flaw does not impact confidentiality or integrity; only availability is affected.

Root Cause

GitLab's upload pipeline did not enforce sufficient size or quota limits for files submitted through functionality available to Developer-tier users. The absence of effective throttling allowed cumulative uploads to consume storage and backend resources beyond what the instance could sustain.

Attack Vector

Exploitation requires network access to the GitLab instance and valid credentials with Developer-level permissions on at least one project. The attacker uploads one or more large files through standard GitLab functionality. No user interaction is required, and the attack can be repeated or scripted to amplify impact. Technical details are tracked in GitLab Issue #554062 and HackerOne Report #3161756.

No public proof-of-concept exploit code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-7337

Indicators of Compromise

Rapid growth in GitLab object storage, repository storage, or attached file volumes without a corresponding business justification.
Unusually large multipart upload requests to GitLab endpoints such as /uploads or project-scoped upload paths.
Repeated upload activity from a single authenticated user or token within a short window.
Alerts from the underlying filesystem or object store indicating capacity thresholds have been exceeded.

Detection Strategies

Monitor GitLab production logs (production_json.log, gitaly, and web server logs) for upload events with large Content-Length values.
Correlate authenticated session identifiers with aggregate bytes uploaded per user per time window.
Track storage utilization trends on GitLab persistence tiers and alert on steep deltas.

Monitoring Recommendations

Enable disk and object storage capacity alerts well below hard limits to allow time to respond.
Review GitLab audit events for upload actions by Developer-level accounts across all projects.
Baseline normal per-user and per-project upload volume so outliers can be identified quickly.

How to Mitigate CVE-2025-7337

Immediate Actions Required

Upgrade GitLab CE/EE to 18.3.2, 18.2.6, or 18.1.6 depending on the installed branch.
Audit recent upload activity by Developer-tier accounts and remove abusive large files.
Rotate or revoke personal access tokens suspected of being used to abuse upload functionality.

Patch Information

GitLab addressed CVE-2025-7337 in the September 10, 2025 patch release. See the GitLab Patch Release 18.3.2 advisory for upgrade instructions and the full list of fixed branches.

Workarounds

Restrict project membership so that only trusted users hold Developer or higher roles until the patch is applied.
Enforce project and group storage quotas within GitLab administrative settings.
Place a reverse proxy or web application firewall in front of GitLab to cap request body sizes on upload endpoints.

bash

# Example NGINX reverse proxy snippet to cap upload size
# Adjust the value to match your organization's legitimate upload needs
server {
    listen 443 ssl;
    server_name gitlab.example.com;

    client_max_body_size 100m;

    location / {
        proxy_pass http://gitlab_upstream;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}