GitLab Fixes High-Severity DoS Flaws: Unauthenticated Attackers Could Crash Instances

GitLab has released security updates for versions 18.4.1, 18.3.3, and 18.2.7 of its Community Edition and Enterprise Edition, after warning that the fixes close several high-severity vulnerabilities that could expose instances to denial of service and information disclosure attacks.

Two high-severity flaws are CVE-2025-10858 (CVSS 7.5) and CVE-2025-8014 (CVSS 7.5); the former could let an unauthenticated attacker render a GitLab instance unresponsive by uploading crafted JSON files, while the latter allowed unauthenticated users to bypass query complexity limits, leading to a Denial of Service condition.

Other fixed vulnerabilities include CVE-2025-9958, CVE-2025-7691, and several GraphQL and authorization issues, with PostgreSQL updates to version 16.10 addressing CVE-2025-8713, CVE-2025-8714, and CVE-2025-8715. Administrators of self-managed GitLab instances should upgrade immediately. According to GitLab, the remediation involved removing the ability for unauthenticated users to cause the observed DoS and information disclosure risks.