A critical vulnerability in GitLab CE/EE allows unauthenticated attackers to cause a denial of service condition by sending malformed authentication requests.

The vulnerability is a resource exhaustion flaw (CWE-770) occurring during the processing of authentication data. Unauthenticated attackers can trigger this condition by submitting specifically crafted requests to the application.

The ability for unauthenticated users to trigger a denial of service condition poses a significant risk to business continuity and service availability. With a CVSS score of 7.5, this high-severity flaw could lead to critical system downtime, preventing legitimate users from accessing repository management, CI/CD pipelines, and other core development operations.

Immediate Action: Upgrade all GitLab CE/EE instances to version 18.6.4, 18.7.2, 18.8.2, or higher immediately.

Proactive Monitoring: Monitor server resource utilization, specifically CPU and memory spikes, and review authentication logs for patterns of malformed or repetitive requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rate-limiting rules to identify and block malformed requests or excessive traffic targeting authentication endpoints.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the referenced HackerOne report.

Given the high CVSS score and the existence of a public proof-of-concept, this vulnerability poses a credible and significant threat to GitLab infrastructure. Organizations must prioritize the application of the provided vendor patches to prevent potential service disruption. Patching should be performed immediately to ensure the stability and security of the development environment.