GitLab CE/EE Denial-of-Service Vulnerability via Large SAML Responses

A denial-of-service vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 7.12 prior to 18.1.6, 18.2 prior to 18.2.6, and 18.3 prior to 18.3.2. This vulnerability could have allowed unauthorized users to disrupt the responsiveness of the GitLab instance for legitimate users by sending multiple large SAML responses concurrently.

Impact

Exploitation of this vulnerability could lead to a significant degradation of service, causing the GitLab instance to become unresponsive to legitimate users.

Remediation

Users are advised to upgrade to GitLab versions 18.3.2, 18.2.6, or 18.1.6. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, see the Updating the Runner page.