Denial of Service Vulnerability in GitLab by GitLab Inc.
CVE-2025-6016

6.5MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
22 April 2026

What is CVE-2025-6016?

GitLab has addressed a critical issue affecting multiple versions of its CE/EE products. This vulnerability allows an authenticated user to cause a denial of service by exploiting insufficient resource allocation limits when retrieving notes under specific conditions. The flaw can disrupt service availability and threatens the stability of GitLab instances, necessitating prompt updates to mitigate potential impacts.

Affected Version(s)

GitLab 9.2 < 18.9.6

GitLab 18.10 < 18.10.4

GitLab 18.11 < 18.11.1

References

https://hackerone.com/reports/3160363
technical-descriptionexploitpermissions-required
https://gitlab.com/gitlab-org/gitlab/-/work_items/548940
https://about.gitlab.com/releases/2026/04/22/patch-releas...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [pwnie](https://hackerone.com/pwnie) for reporting this vulnerability through our HackerOne bug bounty program
.