PT-2026-21990 · Gitlab · Gitlab Ce/Ee

Published 2026-02-25 · Updated 2026-03-02 · CVE-2025-3525

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 9.0 through 18.7.4 GitLab CE/EE versions 18.8 through 18.8.4 GitLab CE/EE versions 18.9 through 18.9.0

Description An authenticated user with specific access permissions could potentially cause a Denial of Service. This can occur by creating specially crafted CI triggers through the API. The API endpoint used in the attack is not specified. The vulnerable component is related to CI triggers.

Recommendations Update GitLab CE/EE to version 18.7.5 or later. Update GitLab CE/EE to version 18.8.5 or later. Update GitLab CE/EE to version 18.9.1 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2026-03430

BIT-GITLAB-2025-3525

CVE-2025-3525

Affected Products

Gitlab Ce/Ee

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3525.json · Exploit
• 🔥 https://hackerone.com/reports/3045257 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-3525 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-3525 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3525 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-3525 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-3525 · Vendor Advisory
• https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-3525 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03430 · Security Note
• https://twitter.com/CVEnew/status/2027099291165343945 · Twitter Post
• https://t.me/CVEtracker/45767 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/535662 · Note
• https://t.me/cveNotify/153527 · Telegram Post