A critical resource exhaustion vulnerability in GitLab CE/EE allows unauthenticated attackers to crash services via malicious JSON file uploads.

This vulnerability is a resource allocation flaw (CWE-770) where the application fails to properly limit the processing of large JSON files. Because the vector is network-accessible and requires no authentication (PR:N), an attacker can remotely trigger a Denial of Service state.

The ability for an unauthenticated actor to force a Denial of Service represents a significant operational risk. With a CVSS score of 7.5, this high-severity flaw could lead to complete service unavailability, disrupting development pipelines and critical business workflows. Unchecked resource consumption can degrade infrastructure stability and necessitate manual service restarts, causing unnecessary downtime and potential loss of productivity.

Immediate Action: Upgrade all instances of GitLab CE/EE to version 18.2.7, 18.3.3, 18.4.1, or higher to implement proper resource throttling.

Proactive Monitoring: Monitor system logs for repeated, failed, or unusually large JSON file upload attempts that correlate with application performance degradation or service crashes.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway configured to inspect and limit the size of incoming JSON payloads before they reach the GitLab application server.

Public Exploit Available: Unknown

Given the ease of execution and the potential for service disruption, organizations should prioritize patching this vulnerability in their next maintenance cycle. Applying the vendor-provided updates is the only definitive way to resolve the underlying resource allocation issue and prevent remote exploitation.