An unauthenticated remote attacker can cause a denial of service in GitLab CE/EE by sending repeated GraphQL queries, potentially disrupting critical development operations.

The application fails to properly validate the quantity of input in GraphQL queries, which allows an unauthenticated user to trigger a denial of service condition through resource exhaustion.

Successful exploitation of this vulnerability results in the unavailability of the GitLab platform, which can halt CI/CD pipelines, repository access, and project management activities. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to business continuity, as it requires no authentication to execute, making it an attractive target for automated disruption.

Immediate Action: Upgrade GitLab CE/EE instances to version 18.8.9, 18.9.5, 18.10.3, or higher immediately to apply the necessary input validation controls.

Proactive Monitoring: Monitor system resource utilization, specifically CPU and memory spikes associated with GraphQL endpoint traffic, to identify potential exploitation attempts.

Compensating Controls: Implement rate limiting on GraphQL query endpoints via a Web Application Firewall (WAF) or load balancer to mitigate the impact of repetitive, resource-intensive requests.

Public Exploit Available: Yes — a published PoC exists, attributed to the security researcher report on HackerOne.

The risk posed by this vulnerability is significant due to the ease of exploitation by unauthenticated actors and the potential for complete service disruption. Administrators must prioritize the application of the vendor-provided patches. If patching cannot occur immediately, aggressive rate limiting and traffic monitoring should be deployed to prevent service degradation.