Denial of Service Vulnerability in GitLab EE by GitLab
CVE-2025-10903

6.5MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
26 August 2026

What is CVE-2025-10903?

An issue has been discovered in GitLab EE affecting multiple versions where an authenticated user could exploit the SCIM user provisioning feature. This vulnerability could lead to a denial of service condition caused by an unbounded loop triggered by specially crafted input. Such an attack can result in significant service disruption. GitLab has addressed this vulnerability in later versions, ensuring that input handling is managed effectively to prevent the potential for service interruption.

Affected Version(s)

GitLab 11.10 < 19.1.7

GitLab 19.2 < 19.2.5

GitLab 19.3 < 19.3.1

References

https://hackerone.com/reports/3292470
technical-descriptionexploitpermissions-required
https://gitlab.com/gitlab-org/gitlab/-/work_items/571842
https://docs.gitlab.com/releases/patches/patch-release-gi...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [rafabd1](https://hackerone.com/rafabd1) for reporting this vulnerability through our HackerOne bug bounty program
.