GitLab Releases Security Update to Patch Multiple DoS-Enabling Vulnerabilities

GitLab has issued a security update to patch four DoS-enabling vulnerabilities affecting both Community Edition and Enterprise Edition, with self-managed installations urged to upgrade to versions 18.4.2, 18.3.4, or 18.2.8. GitLab[.]com has already deployed the patched releases, and GitLab Dedicated customers are unaffected.

The update, delivered as part of GitLab’s regular bi-monthly schedule (the second and fourth Wednesdays), also includes bug fixes that harden GraphQL endpoints, webhook handling, and CI/CD job authorisation. The four vulnerabilities comprise two High severity issues, CVE-2025-10004 and CVE-2025-11340, and two Medium severity issues, CVE-2025-9825 and CVE-2025-2934, with CVSS scores 7.5, 7.7, 5.0, and 4.3 respectively.

Details note that CVE-2025-11340 relates to incorrect authorisation in GraphQL mutations and that CVE-2025-10004 involves DoS via large GraphQL blob queries, while CVE-2025-9825 and CVE-2025-2934 affect CI/CD variables visibility and webhook HTTP responses. Administrators should consult the GitLab releases handbook and security FAQ for upgrade instructions, and keeping systems on the latest patch release reduces exploitation risk.