Denial of Service Vulnerability in GitLab CE/EE
CVE-2025-12664

7.5HIGH

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
8 April 2026

What is CVE-2025-12664?

A denial of service vulnerability exists in GitLab CE/EE, allowing unauthenticated users to disrupt services by sending repeated GraphQL queries. GitLab has released patches for affected versions to prevent exploitation. Users are encouraged to update to the latest versions to maintain system integrity and security.

Affected Version(s)

GitLab 13.0 < 18.8.9

GitLab 18.9 < 18.9.5

GitLab 18.10 < 18.10.3

References

https://hackerone.com/reports/3377091
technical-descriptionexploitpermissions-required
https://gitlab.com/gitlab-org/gitlab/-/work_items/579376
https://about.gitlab.com/releases/2026/04/08/patch-releas...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [foxribeye](https://hackerone.com/foxribeye) for reporting this vulnerability through our HackerOne bug bounty program
.