An unauthenticated remote denial of service vulnerability in GitLab CE/EE poses a significant availability risk to infrastructure.

This vulnerability is caused by improper resource allocation (CWE-770), where the application fails to limit or throttle resources during the processing of specific GraphQL requests. An unauthenticated attacker can exploit this by sending crafted JSON payloads to the GraphQL endpoint, resulting in a denial of service condition.

Successful exploitation results in the exhaustion of system resources, causing the GitLab instance to become unresponsive or crash. Given the critical role of GitLab in development and deployment pipelines, this disruption can halt software delivery, interrupt CI/CD processes, and cause significant downtime for engineering teams. The CVSS score of 7.5 reflects the high impact on availability and the ease of exploitation by unauthenticated actors.

Immediate Action: Upgrade GitLab CE/EE installations to versions 18.3.5, 18.4.3, 18.5.1, or later immediately.

Proactive Monitoring: Monitor server resource utilization, specifically CPU and memory spikes, and review GraphQL access logs for high volumes of anomalous request patterns.

Compensating Controls: Implement rate limiting on the GraphQL endpoint using a Web Application Firewall (WAF) or load balancer to mitigate the impact of malicious payload bursts.

Public Exploit Available: Yes, a published PoC exists, attributed to the security researcher write-up on HackerOne (HackerOne report 3367019).

The severity of this flaw, combined with the lack of required authentication for exploitation, necessitates an immediate patching cycle. Organizations should prioritize updating their GitLab instances to the latest secure versions to prevent service disruption caused by resource exhaustion. Failure to patch leaves critical development infrastructure exposed to trivial denial of service attacks.