CVE-2025-14871 GitLab CVE debrief

Who should care

Defenders responsible for GitLab CE/EE deployments, particularly those using versions 18.4.6 through 19.3.0, should assess exposure and apply patches to prevent potential service disruption. They should also review and update inventory for affected versions, monitor for unusual GraphQL activity, and review compensating controls for exposed systems.

Why it matters

CVE-2025-14871 is a high-severity denial of service vulnerability in GitLab CE/EE that allows unauthenticated users to cause service disruption. Defenders should prioritize patching affected versions and monitoring GraphQL activity.

• Denial of service via GraphQL complexity calculation logic
• Potential for unauthenticated attacks
• Need for patch application and version verification

Technical summary

The vulnerability affects GitLab CE/EE versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. It is caused by improper resource allocation limits in the GraphQL complexity calculation logic, allowing unauthenticated users to cause denial of service. The issue has a high CVSS score of 7.5 and is classified as a high-severity vulnerability. Defenders should prioritize verifying exposure and applying patches for GitLab CE/EE versions 18.4.6 through 19.3.0, as the issue allows unauthenticated denial of service.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for GitLab CE/EE versions 18.4.6 through 19.3.0, as the issue allows unauthenticated denial of service.

Recommended defensive actions

• Verify and apply patches for affected GitLab CE/EE versions
• Review and update inventory for GitLab CE/EE versions 18.4.6 through 19.3.0
• Monitor for unusual GraphQL activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the affected versions and the nature of the vulnerability. Vendor advisories and release notes are available for further guidance. The issue allows unauthenticated denial of service, and defenders should verify exposure and apply patches for GitLab CE/EE versions 18.4.6 through 19.3.0. Evidence limits are based on available source information, and further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.