CVE-2025-1250 — Allocation of Resources Without Limits or Throttling in Gitlab

CWE-770 — Allocation of Resources Without Limits or ThrottlingCWE-1250 — Improper Preservation of Consistency Between Independent Representations of Shared State6 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 85.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
GitlabDebian GitlabGitlab CE+4 more
Timeline
PublishedSep 12
Latest updateDec 5

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user to stall background job processing by sending specially crafted commit messages, merge request descriptions, or notes.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages9 packages

▶CVEListV5gitlab/gitlab15.0 — 18.1.6+2
▶NVDgitlab/gitlab15.0.0 — 18.1.6+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-mmm6-54w9-rfq2: An issue has been discovered in GitLab CE/EE affecting all versions from 15↗2025-09-12
▶

📋Vendor Advisories

4
Red Hat
kde-connect: KDE Connect: Unpairing of devices via invalid broadcast UDP packet↗2025-12-05
▶
GitLab
CVE-2025-1250: An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could hav↗2025-09-12
▶
Debian
CVE-2025-1250: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 be...↗2025
▶
Microsoft
PostgreSQL row security below e.g. subqueries disregards user ID changes↗2024-11-12
▶