PT-2026-3854 · Gitlab · Gitlab Ce/Ee

Published 2026-01-21 · Updated 2026-01-27 · CVE-2025-13335

Positive Technologies · (AI Summary)

CVSS v2.0

6.8

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.1 through 18.6.4 GitLab CE/EE versions 18.7 through 18.7.2 GitLab CE/EE versions 18.8 through 18.8.2

Description GitLab CE/EE is affected by an issue that could allow an authenticated user to create a denial of service condition. This can occur by configuring malformed Wiki documents that bypass cycle detection.

Recommendations Update GitLab CE/EE to version 18.6.4 or later. Update GitLab CE/EE to version 18.7.2 or later. Update GitLab CE/EE to version 18.8.2 or later.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2026-00982

BIT-GITLAB-2025-13335

CVE-2025-13335

Affected Products

Gitlab Ce/Ee

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13335.json · Exploit
• 🔥 https://hackerone.com/reports/3418023 · Exploit
• https://about.gitlab.com/releases/2026/01/21/patch-release-gitlab-18-8-2-released · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-13335 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-13335 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-13335 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13335 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2025-13335 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13335 · Security Note
• https://bdu.fstec.ru/vul/2026-00982 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/581060 · Note
• https://twitter.com/ThreatSynop/status/2013985062333608160 · Twitter Post
• https://t.me/CVEtracker/42768 · Telegram Post
• https://t.me/true_secator/7826 · Telegram Post
• https://t.me/poxek/5851 · Telegram Post