PT-2026-34470 · Gitlab · Gitlab Ce/Ee

Published 2026-04-22 · Updated 2026-04-28 · CVE-2025-3922

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 12.4 through 18.9.5 GitLab CE/EE versions 18.10 through 18.10.3 GitLab CE/EE versions 18.11 through 18.11.0

Description An issue exists where an authenticated user can cause a denial of service by overwhelming system resources. This occurs due to insufficient resource allocation limits within the GraphQL API.

Recommendations Update to version 18.9.6 Update to version 18.10.4 Update to version 18.11.1

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-GITLAB-2025-3922

CVE-2025-3922

Affected Products

Gitlab Ce/Ee

References · 9

• 🔥 https://hackerone.com/reports/3098035 · Exploit
• https://about.gitlab.com/releases/2026/04/22/patch-release-gitlab-18-11-1-released · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-3922 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-3922 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-3922 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3922 · Security Note
• https://ubuntu.com/security/CVE-2025-3922 · Vendor Advisory
• https://twitter.com/CVEnew/status/2047012120001392929 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/work_items/537422 · Note