GitLab up to 19.1.7/19.2.5/19.3.1 GraphQL allocation of resources

Summaryinfo

A vulnerability has been found in GitLab up to 19.1.7/19.2.5/19.3.1 and classified as critical. The affected element is an unknown function of the component GraphQL. This manipulation causes allocation of resources. The identification of this vulnerability is CVE-2025-14871. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in GitLab up to 19.1.7/19.2.5/19.3.1 and classified as critical. Affected by this vulnerability is an unknown part of the component GraphQL. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. The summary by CVE is:

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

It is possible to read the advisory at hackerone.com. This vulnerability is known as CVE-2025-14871 since 12/18/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 19.1.8, 19.2.6 or 19.3.2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Bug Tracking Software

Name

• GitLab

Version

• 19.1.0
• 19.1.1
• 19.1.2
• 19.1.3
• 19.1.4
• 19.1.5
• 19.1.6
• 19.1.7
• 19.2.0
• 19.2.1
• 19.2.2
• 19.2.3
• 19.2.4
• 19.2.5
• 19.3.0
• 19.3.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion