CVE-2025-10867

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.1 through 18.2.6 GitLab CE/EE versions 18.3 through 18.3.2 GitLab CE/EE versions 18.4 through 18.4.0

Description An authenticated user could create a denial-of-service condition by exploiting an unprotected GraphQL API through repeated requests. The issue affects the /api/graphql endpoint. Repeated requests to this API endpoint can lead to service disruption.

Recommendations Update GitLab CE/EE to version 18.2.7 or later. Update GitLab CE/EE to version 18.3.3 or later. Update GitLab CE/EE to version 18.4.1 or later.