Denial of Service Vulnerability in GitLab CE/EE
CVE-2025-3922

6.5MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
22 April 2026

What is CVE-2025-3922?

A vulnerability in GitLab CE/EE allows authenticated users to execute a denial of service attack by exploiting insufficient resource limits in the GraphQL API. This oversight enables users to manipulate system resources, potentially leading to disruption of service for legitimate users. The affected versions range from 12.4 up to 18.11.1, and GitLab has issued patches to mitigate this risk and enhance resource management.

Affected Version(s)

GitLab 12.4 < 18.9.6

GitLab 18.10 < 18.10.4

GitLab 18.11 < 18.11.1

References

https://hackerone.com/reports/3098035
technical-descriptionexploitpermissions-required
https://gitlab.com/gitlab-org/gitlab/-/work_items/537422
https://about.gitlab.com/releases/2026/04/22/patch-releas...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [pwnie](https://hackerone.com/pwnie) for reporting this vulnerability through our HackerOne bug bounty program
.