A critical regular expression denial of service vulnerability in GitLab CE/EE allows unauthenticated attackers to disrupt service availability by submitting malicious merge request payloads.

This flaw stems from inefficient regular expression complexity (CWE-1333). Unauthenticated attackers can trigger this issue by sending specifically crafted input to a merge request endpoint, leading to excessive resource consumption and potential service unavailability.

The vulnerability carries a CVSS score of 7.5, reflecting a significant risk to service availability. Successful exploitation allows an attacker to cause a denial of service, which can halt development operations, delay project timelines, and impede collaboration within the GitLab environment.

Immediate Action: Upgrade GitLab CE/EE instances immediately to versions 18.7.5, 18.8.5, or 18.9.1 to apply the necessary regex optimizations.

Proactive Monitoring: Monitor server CPU and memory utilization patterns during merge request processing to identify potential spikes caused by malicious payloads.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and filter incoming merge request traffic for suspicious or overly complex patterns that may trigger regex processing errors.

Public Exploit Available: Yes, a published proof of concept exists, attributed to the security report referenced on HackerOne.

Given the availability of a proof of concept and the relative ease of exploitation for unauthenticated actors, organizations must prioritize this update. Administrators should verify their current version against the affected list and perform the recommended patch deployment during the next maintenance window to prevent potential service disruptions.