PT-2025-22459 · Gitlab · Gitlab Ce/Ee

Published 2025-05-21 · Updated 2025-06-09 · CVE-2025-0993

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions prior to 17.10.7 GitLab CE/EE version 17.11 prior to 17.11.3 GitLab CE/EE version 18.0 prior to 18.0.1

Description An issue has been discovered in GitLab CE/EE that could allow an authenticated attacker to cause a denial of service condition by exhausting server resources. This issue can lead to system downtime and resource exhaustion across platforms and integrations. The patched vulnerabilities were not used in the wild, and users are strongly advised to update to the latest versions to mitigate risks.

Recommendations For GitLab CE/EE versions prior to 17.10.7, upgrade to version 17.10.7 or later. For GitLab CE/EE version 17.11 prior to 17.11.3, upgrade to version 17.11.3 or later. For GitLab CE/EE version 18.0 prior to 18.0.1, upgrade to version 18.0.1 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2025-06006

BIT-GITLAB-2025-0993

CVE-2025-0993

Affected Products

Gitlab Ce/Ee

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0993.json · Exploit
• 🔥 https://hackerone.com/reports/2967771 · Exploit
• https://ubuntu.com/security/CVE-2025-0993 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-0993 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2025-0993 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-0993 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06006 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-0993 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-0993 · Vendor Advisory
• https://twitter.com/CVEnew/status/1925565852054663360 · Twitter Post
• https://twitter.com/CCBalert/status/1925511174176567644 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1925539296901030266 · Twitter Post
• https://reddit.com/r/GitProtect/comments/1ksnb7z/highseverity_flaws_fixed_in_latest_gitlab_and · Reddit Post
• https://t.me/true_secator/7066 · Telegram Post
• https://about.gitlab.com/releases/2025/05/21/patch-release-gitlab-18-0-1-released · Note