GitLab CE/EE Denial-of-Service Vulnerability in GraphQL Blob Type

A denial-of-service vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 13.12 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2. This vulnerability can cause the GitLab instance to become unresponsive or severely degraded. It is triggered by sending crafted GraphQL queries that request large repository blobs.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, causing the GitLab instance to become unresponsive or severely degraded.

Remediation

Users are strongly recommended to upgrade to GitLab versions 18.4.2, 18.3.4, or 18.2.8. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, see the Updating the Runner page.