CVE-2025-7449: GitLab CE/EE Denial of Service Vulnerability

CVE-2025-7449 Overview

GitLab has patched a denial of service (DoS) vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw affects all versions from 8.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1. An authenticated user with specific permissions can trigger a denial of service condition through HTTP response processing. The weakness is categorized under [CWE-770] (Allocation of Resources Without Limits or Throttling). GitLab addressed the issue in patch release 18.6.1 on November 26, 2025.

Critical Impact
Authenticated attackers with low privileges can cause high availability impact against GitLab instances by abusing HTTP response handling logic, disrupting DevOps operations for all users.

Affected Products

GitLab Community Edition (CE) versions 8.3 through 18.4.4
GitLab Enterprise Edition (EE) versions 18.5 through 18.5.2
GitLab CE/EE version 18.6.0

Discovery Timeline

2025-11-26 - GitLab releases patch versions 18.6.1, 18.5.3, and 18.4.5
2025-11-26 - CVE-2025-7449 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7449

Vulnerability Analysis

The vulnerability resides in how GitLab processes HTTP responses within CE/EE. An authenticated user with specific permissions can send crafted requests that trigger uncontrolled resource consumption during response handling. The flaw persists across a wide version range, indicating a long-standing weakness in the response processing pipeline. Successful exploitation degrades or disables the availability of the affected GitLab instance without compromising confidentiality or integrity of data.

Root Cause

The root cause maps to [CWE-770], allocation of resources without limits or throttling. GitLab's HTTP response processing does not adequately constrain resources consumed during specific operations. This lets an authenticated actor with the required permissions force the application into a state where memory, CPU, or worker threads are exhausted. Public technical details are limited pending the disclosure window on the associated HackerOne Report #3215054 and GitLab Issue #554938.

Attack Vector

Exploitation requires network access to the GitLab instance and valid authenticated credentials with specific permissions. No user interaction is required. The attacker abuses features that process HTTP responses, causing resource exhaustion that stops legitimate users from accessing repositories, pipelines, and issue tracking. Because GitLab often sits at the center of DevOps workflows, a successful DoS halts continuous integration and delivery activity.

No public proof-of-concept or exploit code is available. The vulnerability mechanism is described in prose only. Refer to the GitLab Patch Release Announcement for vendor-authoritative context.

Detection Methods for CVE-2025-7449

Indicators of Compromise

Sudden spikes in GitLab worker process memory or CPU utilization not tied to scheduled jobs or pipeline load
Unresponsive GitLab web UI or API endpoints while the host operating system remains reachable
Repeated requests from a single authenticated session targeting endpoints associated with HTTP response processing

Detection Strategies

Monitor GitLab application logs (production.log, api_json.log) for abnormal request rates from individual users or tokens
Baseline normal Puma/Sidekiq worker resource usage and alert on sustained deviations
Correlate authenticated user activity with availability incidents to identify potential abuse patterns

Monitoring Recommendations

Ingest GitLab logs and host telemetry into a centralized SIEM for query and correlation across sessions
Track running versions of GitLab CE/EE across the estate to confirm patched builds are deployed
Alert on GitLab process restarts, out-of-memory events, and reverse proxy 5xx error rate increases

How to Mitigate CVE-2025-7449

Immediate Actions Required

Upgrade GitLab CE/EE to 18.6.1, 18.5.3, or 18.4.5 depending on your current major version
Audit user accounts and access tokens with the permissions required to reach the vulnerable code path
Rotate credentials for any accounts that showed anomalous activity prior to patching

Patch Information

GitLab released fixed versions 18.4.5, 18.5.3, and 18.6.1 on November 26, 2025. Self-managed administrators should upgrade immediately following the guidance in the GitLab Patch Release Announcement. GitLab.com and Dedicated instances are already running the patched code per GitLab's standard release process.

Workarounds

Restrict access to GitLab instances to trusted networks using a VPN or IP allowlist while planning the upgrade
Reduce the number of accounts holding the specific permissions referenced in the advisory to shrink the attack surface
Deploy rate limiting at the reverse proxy or GitLab application layer to constrain abusive request patterns

bash

# Verify installed GitLab version before and after upgrade
sudo gitlab-rake gitlab:env:info | grep "GitLab information" -A 5

# Debian/Ubuntu upgrade example
sudo apt-get update && sudo apt-get install gitlab-ee=18.6.1-ee.0

# RHEL/CentOS upgrade example
sudo yum install gitlab-ee-18.6.1-ee.0

# Enable application-level rate limiting via Admin Area > Settings > Network