Denial of Service Vulnerability in GitLab by GitLab Inc.
CVE-2025-10497

7.5HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
27 October 2025

What is CVE-2025-10497?

GitLab has addressed a vulnerability in its Community Edition and Enterprise Edition (CE/EE) that could allow an unauthenticated attacker to trigger a denial of service condition. This issue affects multiple versions, including those prior to 18.3.5, 18.4.3, and 18.5.1. Attackers could exploit this vulnerability by sending specially crafted payloads, leading to service disruption. Users are encouraged to update their GitLab instances to the latest versions to ensure protection against this issue.

Affected Version(s)

GitLab 17.10 < 18.3.5

GitLab 18.4 < 18.4.3

GitLab 18.5 < 18.5.1

References

https://about.gitlab.com/releases/2025/10/22/patch-releas...
https://gitlab.com/gitlab-org/gitlab/-/issues/570336
issue-trackingpermissions-required
https://hackerone.com/reports/3338151
technical-descriptionexploitpermissions-required

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [a92847865](https://hackerone.com/a92847865) for reporting this vulnerability through our HackerOne bug bounty program
JSON
.
CVE-2025-10497 : Denial of Service Vulnerability in GitLab by GitLab Inc.