GitLab CE/EE Denial-of-Service Vulnerability in GraphQL API

A denial-of-service vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 18.5 prior to 18.8.7, 18.9 prior to 18.9.3, and 18.10 prior to 18.10.1. The issue arises from improper input validation in GraphQL request processing, which could have allowed an unauthenticated user to make the GitLab instance unresponsive.

Impact

Exploitation of this vulnerability could lead to the GitLab instance becoming unresponsive, causing a denial-of-service condition.

Remediation

Users are advised to upgrade to GitLab versions 18.10.1, 18.9.3, or 18.8.7. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, see the Updating the Runner page.