An unauthenticated denial of service vulnerability in GitLab CE and EE allows remote attackers to crash or degrade service performance through repeated, resource-intensive GraphQL queries.

The application fails to implement proper resource limits or throttling on GraphQL queries, which allows an unauthenticated attacker to trigger a denial of service condition by sending repeated, complex requests.

Successful exploitation of this vulnerability can lead to significant service disruption and downtime for users relying on the GitLab platform. With a CVSS score of 7.5, this high-severity flaw poses a risk to operational continuity, as an attacker does not require authentication to impact the availability of critical development infrastructure.

Immediate Action: Upgrade your GitLab CE or EE instance to versions 18.6.6, 18.7.4, 18.8.4, or later immediately to apply the necessary resource throttling patches.

Proactive Monitoring: Monitor server CPU and memory utilization patterns for spikes associated with GraphQL endpoint traffic, and audit access logs for high volumes of repetitive queries from single sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rate-limiting rules configured to detect and block anomalous patterns of GraphQL requests directed at the GitLab instance.

Public Exploit Available: Yes, a published proof-of-concept exists as detailed in the referenced HackerOne report.

Given the ease of exploitability and the potential for total service disruption, administrators should prioritize this update within their standard patching cycle. Applying the vendor-supplied fix is the only definitive way to implement the resource throttling required to neutralize this vulnerability.