GitLab Urges Immediate Update for Two High-Severity Flaws

GitLab has released new versions of its Community and Enterprise Editions to address several security vulnerabilities, including two high-severity flaws that could disrupt services and compromise data. CVE-2025-2256 covers Denial of Service in SAML responses, potentially rendering a GitLab instance unresponsive when presented with multiple large SAML responses, with a CVSS score of 7.5; affected versions include all GitLab CE/EE from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2.

CVE-2025-6454 is a Server-Side Request Forgery in webhook custom headers that could enable authenticated users to make unintended internal requests within a proxy environment, carrying a CVSS score of 8.5; it affects all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2. In addition, several other CVEs—CVE-2025-1250, CVE-2025-7337, CVE-2025-10094 and CVE-2025-6769—represent Denial of Service or information disclosure issues across various components. All self-managed GitLab installations are strongly advised to upgrade immediately to versions 18.3.2, 18.2.6, or 18.1.6 to mitigate these risks.