CVE-2025-8099: GitLab CE/EE DoS Vulnerability

CVE-2025-8099 Overview

A denial of service vulnerability has been identified in GitLab CE/EE that affects all versions from 10.8 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4. Under certain conditions, this vulnerability could allow an unauthenticated user to cause denial of service by sending repeated GraphQL queries to the GitLab server.

Critical Impact

Unauthenticated attackers can exhaust server resources and render GitLab instances unavailable by exploiting improper resource allocation controls in the GraphQL API endpoint.

Affected Products

• GitLab Community Edition (CE) versions 10.8 to 18.6.5
• GitLab Enterprise Edition (EE) versions 10.8 to 18.6.5
• GitLab CE/EE versions 18.7.0 to 18.7.3
• GitLab CE/EE versions 18.8.0 to 18.8.3

Discovery Timeline

• 2026-02-10 - GitLab releases security patch (versions 18.6.6, 18.7.4, 18.8.4)
• 2026-02-11 - CVE CVE-2025-8099 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2025-8099

Vulnerability Analysis

This vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw resides in GitLab's GraphQL API implementation, which fails to properly limit or throttle resource consumption when processing repeated queries. GraphQL APIs are particularly susceptible to resource exhaustion attacks due to their flexible query structure, which allows clients to request deeply nested or complex data in a single request.

The vulnerability enables unauthenticated remote attackers to send specially crafted or repeated GraphQL queries that consume excessive server resources, including CPU, memory, and database connections. This can lead to service degradation or complete unavailability of the GitLab instance.

Root Cause

The root cause of this vulnerability is the lack of proper rate limiting and resource allocation controls in GitLab's GraphQL query processing engine. Without adequate safeguards, the server cannot distinguish between legitimate API usage and malicious query flooding, allowing attackers to overwhelm system resources through sustained query bombardment.

The CWE-770 classification indicates that the application allocates reusable resources without implementing appropriate mechanisms to limit the rate of allocation, the total quantity of resources allocated, or the lifetime of each allocation. In this case, the GraphQL endpoint processes incoming queries without sufficient throttling mechanisms.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying the GraphQL endpoint on a vulnerable GitLab instance (typically /api/graphql)
2. Crafting queries that consume significant server resources
3. Sending repeated queries in rapid succession to exhaust available resources
4. Causing the GitLab service to become unresponsive to legitimate users

The vulnerability can be exploited remotely over the network, making internet-facing GitLab instances particularly at risk. The attack specifically targets the GraphQL API's resource handling, where repeated query submissions can lead to resource exhaustion and service denial.

Detection Methods for CVE-2025-8099

Indicators of Compromise

• Unusually high volume of requests to the /api/graphql endpoint from single or multiple IP addresses
• Elevated CPU and memory utilization on GitLab application servers without corresponding legitimate user activity
• Increased database connection pool exhaustion or query timeouts
• GitLab application logs showing repeated GraphQL query patterns from unauthenticated sources

Detection Strategies

• Configure web application firewall (WAF) rules to detect and alert on abnormal GraphQL request volumes
• Monitor GitLab access logs for patterns of repeated unauthenticated requests to the GraphQL endpoint
• Implement rate limiting detection at the network edge to identify potential DoS attack patterns
• Deploy SentinelOne Singularity platform for real-time behavioral analysis of resource exhaustion attempts

Monitoring Recommendations

• Set up alerting thresholds for GraphQL endpoint request rates exceeding normal operational baselines
• Monitor server resource metrics (CPU, memory, network I/O) with automatic alerting for anomalous spikes
• Enable GitLab's built-in audit logging and review for suspicious API access patterns
• Implement network flow analysis to detect distributed denial of service patterns targeting GitLab infrastructure

How to Mitigate CVE-2025-8099

Immediate Actions Required

• Upgrade GitLab CE/EE to patched versions: 18.6.6, 18.7.4, or 18.8.4 immediately
• Implement rate limiting on the GraphQL endpoint at the load balancer or reverse proxy level
• Review and restrict network access to GitLab instances from untrusted networks where possible
• Enable GitLab's built-in rate limiting features and adjust thresholds based on normal usage patterns

Patch Information

GitLab has released security patches addressing this vulnerability. Organizations should upgrade to the following fixed versions:

• Version 18.6.6 - For installations on the 18.6.x branch
• Version 18.7.4 - For installations on the 18.7.x branch
• Version 18.8.4 - For installations on the 18.8.x branch

Detailed patch information is available in the GitLab Patch Release Announcement. Additional technical discussion can be found in GitLab Issue #557165 and HackerOne Report #3240210.

Workarounds

• Deploy a web application firewall (WAF) with rate limiting rules specifically for the /api/graphql endpoint
• Configure reverse proxy (nginx, Apache) rate limiting to restrict requests per IP to the GraphQL API
• Implement IP-based access controls to restrict GraphQL endpoint access to trusted networks only
• Consider temporarily disabling public access to the GraphQL API if not required for operations

# Example nginx rate limiting configuration for GitLab GraphQL endpoint
# Add to nginx configuration file

limit_req_zone $binary_remote_addr zone=graphql_limit:10m rate=10r/s;

location /api/graphql {
    limit_req zone=graphql_limit burst=20 nodelay;
    limit_req_status 429;
    
    # Existing GitLab proxy configuration
    proxy_pass http://gitlab-workhorse;
}