PT-2026-24710 · Gitlab · Gitlab Ce/Ee

Published 2026-03-11 · Updated 2026-03-15 · CVE-2025-14513

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.11 through 18.7.5 GitLab CE/EE versions 18.8 through 18.8.5 GitLab CE/EE versions 18.9 through 18.9.1

Description An issue in GitLab CE/EE could allow an unauthenticated user to cause a denial of service condition. This is due to improper input validation when processing specially crafted JSON payloads in the protected branches API. The issue affects the processing of payloads sent to the /protected branches API endpoint. The vulnerability stems from insufficient validation of the JSON data received, potentially leading to resource exhaustion or other disruptive behavior.

Recommendations GitLab versions 16.11 through 18.7.5 should be upgraded to version 18.7.6 or later. GitLab versions 18.8 through 18.8.5 should be upgraded to version 18.8.6 or later. GitLab versions 18.9 through 18.9.1 should be upgraded to version 18.9.2 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1284

Related Identifiers

BDU:2026-04676

BIT-GITLAB-2025-14513

CVE-2025-14513

Affected Products

Gitlab Ce/Ee

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14513.json · Exploit
• 🔥 https://hackerone.com/reports/3452477 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-14513 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04676 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2025-14513 · Vendor Advisory
• https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14513 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-14513 · Security Note
• https://ubuntu.com/security/CVE-2025-14513 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14513 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14513 · Note
• https://t.me/cveNotify/155389 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/work_items/583718 · Note
• https://twitter.com/CVEnew/status/2032998316003180671 · Twitter Post