CVE-2025-8099: GitLab CE/EE DoS Vulnerability

CVE-2025-8099 Overview

A denial of service vulnerability has been identified in GitLab CE/EE that affects all versions from 10.8 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4. Under certain conditions, this vulnerability could allow an unauthenticated user to cause denial of service by sending repeated GraphQL queries to the GitLab server.

Critical Impact
Unauthenticated attackers can exhaust server resources and render GitLab instances unavailable by exploiting improper resource allocation controls in the GraphQL API endpoint.

Affected Products

GitLab Community Edition (CE) versions 10.8 to 18.6.5
GitLab Enterprise Edition (EE) versions 10.8 to 18.6.5
GitLab CE/EE versions 18.7.0 to 18.7.3
GitLab CE/EE versions 18.8.0 to 18.8.3

Discovery Timeline

2026-02-10 - GitLab releases security patch (versions 18.6.6, 18.7.4, 18.8.4)
2026-02-11 - CVE CVE-2025-8099 published to NVD
2026-02-11 - Last updated in NVD database

Technical Details for CVE-2025-8099

Vulnerability Analysis

This vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw resides in GitLab's GraphQL API implementation, which fails to properly limit or throttle resource consumption when processing repeated queries. GraphQL APIs are particularly susceptible to resource exhaustion attacks due to their flexible query structure, which allows clients to request deeply nested or complex data in a single request.

The vulnerability enables unauthenticated remote attackers to send specially crafted or repeated GraphQL queries that consume excessive server resources, including CPU, memory, and database connections. This can lead to service degradation or complete unavailability of the GitLab instance.

Root Cause

The root cause of this vulnerability is the lack of proper rate limiting and resource allocation controls in GitLab's GraphQL query processing engine. Without adequate safeguards, the server cannot distinguish between legitimate API usage and malicious query flooding, allowing attackers to overwhelm system resources through sustained query bombardment.

The CWE-770 classification indicates that the application allocates reusable resources without implementing appropriate mechanisms to limit the rate of allocation, the total quantity of resources allocated, or the lifetime of each allocation. In this case, the GraphQL endpoint processes incoming queries without sufficient throttling mechanisms.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying the GraphQL endpoint on a vulnerable GitLab instance (typically /api/graphql)
Crafting queries that consume significant server resources
Sending repeated queries in rapid succession to exhaust available resources
Causing the GitLab service to become unresponsive to legitimate users

The vulnerability can be exploited remotely over the network, making internet-facing GitLab instances particularly at risk. The attack specifically targets the GraphQL API's resource handling, where repeated query submissions can lead to resource exhaustion and service denial.

Detection Methods for CVE-2025-8099

Indicators of Compromise

Unusually high volume of requests to the /api/graphql endpoint from single or multiple IP addresses
Elevated CPU and memory utilization on GitLab application servers without corresponding legitimate user activity
Increased database connection pool exhaustion or query timeouts
GitLab application logs showing repeated GraphQL query patterns from unauthenticated sources

Detection Strategies

Configure web application firewall (WAF) rules to detect and alert on abnormal GraphQL request volumes
Monitor GitLab access logs for patterns of repeated unauthenticated requests to the GraphQL endpoint
Implement rate limiting detection at the network edge to identify potential DoS attack patterns
Deploy SentinelOne Singularity platform for real-time behavioral analysis of resource exhaustion attempts

Monitoring Recommendations

Set up alerting thresholds for GraphQL endpoint request rates exceeding normal operational baselines
Monitor server resource metrics (CPU, memory, network I/O) with automatic alerting for anomalous spikes
Enable GitLab's built-in audit logging and review for suspicious API access patterns
Implement network flow analysis to detect distributed denial of service patterns targeting GitLab infrastructure

How to Mitigate CVE-2025-8099

Immediate Actions Required

Upgrade GitLab CE/EE to patched versions: 18.6.6, 18.7.4, or 18.8.4 immediately
Implement rate limiting on the GraphQL endpoint at the load balancer or reverse proxy level
Review and restrict network access to GitLab instances from untrusted networks where possible
Enable GitLab's built-in rate limiting features and adjust thresholds based on normal usage patterns

Patch Information

GitLab has released security patches addressing this vulnerability. Organizations should upgrade to the following fixed versions:

Version 18.6.6 - For installations on the 18.6.x branch
Version 18.7.4 - For installations on the 18.7.x branch
Version 18.8.4 - For installations on the 18.8.x branch

Detailed patch information is available in the GitLab Patch Release Announcement. Additional technical discussion can be found in GitLab Issue #557165 and HackerOne Report #3240210.

Workarounds

Deploy a web application firewall (WAF) with rate limiting rules specifically for the /api/graphql endpoint
Configure reverse proxy (nginx, Apache) rate limiting to restrict requests per IP to the GraphQL API
Implement IP-based access controls to restrict GraphQL endpoint access to trusted networks only
Consider temporarily disabling public access to the GraphQL API if not required for operations

bash

# Example nginx rate limiting configuration for GitLab GraphQL endpoint
# Add to nginx configuration file

limit_req_zone $binary_remote_addr zone=graphql_limit:10m rate=10r/s;

location /api/graphql {
    limit_req zone=graphql_limit burst=20 nodelay;
    limit_req_status 429;
    
    # Existing GitLab proxy configuration
    proxy_pass http://gitlab-workhorse;
}