GitLab EE Denial-of-Service Vulnerability in Dashboard via GraphQL Queries

A denial-of-service vulnerability has been identified in GitLab Enterprise Edition (EE) versions 15.6 prior to 18.6.6, 18.7 prior to 18.7.4, and 18.8 prior to 18.8.4. This vulnerability allowed authenticated users to cause service disruption by uploading malicious files to the dashboard and repeatedly querying these files through GraphQL, leading to resource exhaustion.

Impact

Exploitation of this vulnerability could cause a denial-of-service condition, disrupting normal user activities by overloading the server with excessive processing demands.

Remediation

Users are advised to upgrade to GitLab EE versions 18.8.4, 18.7.4, or 18.6.6.