GitLab CE/EE is affected by a critical denial of service vulnerability that allows unauthenticated attackers to bypass query complexity limits and exhaust system resources.

The vulnerability, categorized under CWE-770, involves the allocation of resources without appropriate limits. An unauthenticated attacker can trigger this by sending specially crafted GraphQL queries that circumvent established complexity thresholds, leading to service degradation or failure.

Successful exploitation of this vulnerability results in a denial of service, which can significantly impact business continuity by rendering the GitLab instance unavailable to users. Given the CVSS score of 7.5, this high-severity flaw poses a risk to operational stability, as it allows external actors to disrupt development workflows and CI/CD pipelines without requiring any user credentials.

Immediate Action: Upgrade all instances of GitLab CE/EE to versions 18.4.6, 18.5.4, 18.6.2, or later to implement the necessary query complexity enforcement.

Proactive Monitoring: Monitor server CPU and memory utilization patterns, as well as GraphQL endpoint logs, for sudden spikes or repetitive, resource-intensive query patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) or API gateway capable of inspecting GraphQL requests and rate-limiting or blocking queries that exceed defined complexity parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked HackerOne report (reference: https://hackerone.com/reports/3360710).

The ability for an unauthenticated attacker to cause a denial of service via standard API endpoints presents an unacceptable risk to infrastructure availability. Organizations should prioritize the application of the vendor-provided patches immediately to restore proper resource throttling and prevent potential service disruption.