Multiple Vulnerabilities in GitLab Patched, Blocking DoS and SSRF Attack Vectors

On September 10, 2025, GitLab announced critical security updates addressing six significant vulnerabilities that could lead to denial-of-service (DoS) attacks, server-side request forgery (SSRF), and information disclosure. The updates include versions 18.3.2, 18.2.6, and 18.1.6 for both Community and Enterprise Editions, with immediate upgrades recommended for self-managed installations.

The most severe vulnerability, CVE-2025-6454, has a CVSS score of 8.5, allowing authenticated users to exploit SSRF through webhook headers. Other vulnerabilities include CVE-2025-2256 (DoS via SAML response manipulation) and several medium-severity issues affecting file uploads and token operations. All vulnerabilities were identified through GitLab's HackerOne bug bounty program, emphasizing the importance of timely updates to mitigate risks.