A critical vulnerability in GitLab CE/EE allows unauthenticated attackers to cause a denial of service by sending multiple concurrent large SAML responses to the application.

The flaw is an improper validation of specified quantity in input (CWE-1284), which allows unauthenticated remote attackers to trigger resource exhaustion by submitting excessive or oversized SAML authentication responses.

Successful exploitation of this vulnerability results in a denial of service, effectively taking the GitLab instance offline for all legitimate users. Given the central role of GitLab in development workflows and CI/CD pipelines, this disruption can halt software delivery, delay critical releases, and impede team productivity. The CVSS score of 7.5 reflects the high impact on availability, particularly for organizations relying on GitLab for continuous operational requirements.

Immediate Action: Upgrade GitLab CE/EE to version 18.1.6, 18.2.6, 18.3.2, or later immediately to apply the necessary input validation patches.

Proactive Monitoring: Monitor server resource utilization, specifically CPU and memory spikes associated with SAML authentication endpoints, and review access logs for high volumes of unexpected or oversized SAML traffic.

Compensating Controls: Implement rate limiting on authentication endpoints at the Web Application Firewall (WAF) or load balancer level to restrict the number of concurrent requests from individual sources.

Public Exploit Available: Yes, a published PoC exists, attributed to the technical report on HackerOne (ID 3019485).

The risk posed by this vulnerability is significant due to the ease of execution and the potential for total service outage. Organizations should prioritize patching their GitLab environments to the specified versions or higher. If immediate patching is not feasible, ensure that network controls are in place to inspect and limit SAML-related traffic to prevent resource exhaustion.