Introduction
A single unauthenticated request can make a GitLab instance unresponsive, which disrupts development pipelines and collaboration for the organizations that rely on it. CVE-2025-10004 is a flaw in API resource controls that can cause a denial of service condition across a broad range of GitLab deployments.
GitLab is a DevSecOps platform that organizations worldwide use for source code management, continuous integration, and collaborative software development. It has millions of users and is widely adopted across industries, so vulnerabilities in GitLab carry significant operational impact.
Technical information
CVE-2025-10004 is a denial of service vulnerability in GitLab CE and EE. It lies in how the GraphQL API handles blob type queries. A remote, unauthenticated attacker can send specially crafted GraphQL queries that request large repository blobs. The affected versions have insufficient limits on resource allocation and no throttling, so the server processes these oversized blob requests and consumes excessive memory and CPU. The result can be severe performance degradation or a GitLab instance that becomes completely unavailable.
The root cause is that GitLab does not properly validate or restrict the size of blobs or the complexity of GraphQL queries. An attacker can exhaust server resources by requesting large objects repeatedly. The attack works over the network and requires no authentication. The vulnerability is classified under CWE-770: Allocation of Resources Without Limits or Throttling. It was responsibly disclosed through HackerOne, and GitLab acknowledged it in its October 2025 security advisory.
Affected systems and versions
CVE-2025-10004 affects the following GitLab versions:
- GitLab CE/EE from 13.12 up to and including 18.2.8
- GitLab CE/EE from 18.3 up to and including 18.3.4
- GitLab CE/EE from 18.4 up to and including 18.4.2
Every configuration of these versions is vulnerable if the GraphQL API is exposed. The vulnerability affects both self-managed and enterprise deployments.
Vendor security history
GitLab has a history of critical vulnerabilities, including earlier issues in GraphQL and webhook endpoints. The October 2025 patch release fixed several high- and medium-severity vulnerabilities, such as CVE-2025-11340 (incorrect authorization in GraphQL mutations) and CVE-2025-2934 (denial of service in webhook endpoints). GitLab typically responds quickly to critical reports through its HackerOne bug bounty program and coordinated disclosure process. API-related vulnerabilities keep recurring in GitLab, which shows that complex, API-driven platforms remain hard to secure.
