A critical resource exhaustion vulnerability in GitLab CE/EE allows unauthenticated remote attackers to degrade or crash instances by submitting specifically crafted GraphQL queries.

This flaw is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). An unauthenticated attacker can trigger this condition by sending malformed GraphQL requests that force the server to process excessively large repository blobs, leading to service degradation or complete unresponsiveness.

This vulnerability poses a significant risk to service availability, as it can be exploited by any unauthenticated network user to induce a denial of service state. Given the CVSS score of 7.5, the impact on business operations is high because a successful attack disrupts development workflows, CI/CD pipelines, and access to critical source code repositories, potentially resulting in extended downtime.

Immediate Action: Administrators must upgrade their GitLab instances to the patched versions 18.2.8, 18.3.4, or 18.4.2 immediately to implement necessary resource limits.

Proactive Monitoring: Security teams should monitor server resource utilization, specifically CPU and memory spikes correlated with GraphQL API traffic, and review access logs for high volumes of unexpected blob-related queries.

Compensating Controls: Deploying a Web Application Firewall (WAF) with rate-limiting rules specifically targeting the GraphQL endpoint can help mitigate the impact while the patch is being scheduled.

Public Exploit Available: Yes, a published PoC exists, attributed to the technical write-up on HackerOne (report 3026555).

The ease of exploitation for this vulnerability necessitates immediate attention. Organizations must prioritize applying the provided security updates to ensure the stability and availability of their GitLab infrastructure, as the absence of resource limits on GraphQL queries presents a clear and present risk of service disruption.