PT-2025-50574 · Gitlab · Gitlab Ce/Ee

Thong Kuah · Published 2025-12-10 · Updated 2025-12-23 · CVE-2025-14157

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 6.3 through 18.4.5 GitLab CE/EE versions 18.5 through 18.5.3 GitLab CE/EE versions 18.6 through 18.6.1

Description An authenticated user could potentially cause a Denial of Service condition by sending specially crafted API calls containing large content parameters. The issue affects the processing of API requests with oversized data, potentially leading to resource exhaustion or service disruption.

Recommendations Update GitLab CE/EE to version 18.4.6 or later. Update GitLab CE/EE to version 18.5.4 or later. Update GitLab CE/EE to version 18.6.2 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2025-15827

BIT-GITLAB-2025-14157

CVE-2025-14157

Affected Products

Gitlab Ce/Ee

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14157.json · Exploit
• https://bdu.fstec.ru/vul/2025-15827 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14157 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-14157 · Vendor Advisory
• https://about.gitlab.com/releases/2025/12/10/patch-release-gitlab-18-6-2-released · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-14157 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-14157 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-14157 · Vendor Advisory
• https://gitlab.com/gitlab-org/gitlab/-/issues/574324 · Note
• https://twitter.com/CVEnew/status/1999108878051790971 · Twitter Post
• https://t.me/cveNotify/146707 · Telegram Post
• https://t.me/CVEtracker/39448 · Telegram Post
• https://docs.gitlab.com/api/commits · Note