CVE-2025-10004

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-10004
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-10004.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-10004
Aliases
Downstream
Published
2025-10-09T12:04:30.109Z
Modified
2025-12-02T02:45:37.438810Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Allocation of Resources Without Limits or Throttling in GitLab
Details

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs.

Database specific 
{
    "cwe_ids": [
        "CWE-770"
    ],
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10004.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
12a3ec8fb4a540576b2d47247bc86ea7e2c7565b
Fixed
064b7e40da0b30ea250d4486cc3f08c5328a4165
Database specific 
{
    "versions": [
        {
            "introduced": "13.12"
        },
        {
            "fixed": "18.2.8"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
94282cd9b41643ecd8a82da6cf46834cd9609afe
Fixed
5f66dfbe719f204a376af73ef283481886cf08d2
Database specific 
{
    "versions": [
        {
            "introduced": "18.3"
        },
        {
            "fixed": "18.3.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
9255f56b45844196bb7657a9f1fde6aa65a5d08d
Fixed
527e88bdddb02340974a968de1ddcfa4ed7735e5
Database specific 
{
    "versions": [
        {
            "introduced": "18.4"
        },
        {
            "fixed": "18.4.2"
        }
    ]
}

Affected versions

v18.*

v18.3.0-ee
v18.3.1-ee
v18.3.2-ee
v18.3.3-ee
v18.4.0-ee
v18.4.1-ee