Introduction
GitLab recently patched an input validation flaw in its Duo Workflows API. The flaw lets any unauthenticated remote attacker force unbounded resource allocation on the server, which results in a complete denial of service. It has a CVSS 3.1 score of 7.5 and requires no authentication at all, so it is a meaningful risk to every internet-facing, self-managed GitLab instance running versions 18.5 through the latest unpatched releases.
Technical information
Root cause: unbounded resource allocation (CWE-770)
The vulnerability is in the Duo Workflows API, a feature GitLab first introduced in version 18.5. The API endpoint accepts incoming JSON payloads without adequately validating their size or structure, which maps directly to CWE-770: Allocation of Resources Without Limits or Throttling.
When a request arrives at the Duo Workflows API, the server parses and processes the JSON body. Before the patch there was no bounds checking and no limit on resource consumption, so an attacker could craft a JSON payload that forces the server to allocate excessive memory or CPU resources. The result is service degradation or a complete denial of service for every user of the GitLab instance.
CVSS breakdown
The full CVSS 3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
| Metric | Value | What it means |
|---|---|---|
| Attack Vector | Network | The vulnerability is exploitable remotely over the internet. |
| Attack Complexity | Low | No advanced exploitation techniques or specific timing conditions are required. |
| Privileges Required | None | The attacker needs no account and no authentication of any kind. |
| User Interaction | None | The exploit runs without any involvement from a legitimate user. |
| Scope | Unchanged | The impact stays within the vulnerable component itself. |
| Confidentiality / Integrity | None | No data is leaked or modified. |
| Availability | High | The availability of the GitLab service can be completely compromised. |
Attack flow
Based on the available advisory information, the exploitation path is straightforward:
- The attacker finds a GitLab instance exposed to the network. This needs no authentication and no reconnaissance of user accounts.
- The attacker crafts a JSON payload structured to trigger excessive resource allocation when the Duo Workflows API endpoint parses it.
- The attacker sends the payload to the Duo Workflows API. The endpoint does not require authentication, so it accepts and processes the request.
- The server starts allocating memory or processing resources to handle the malicious payload. With no cap or throttle, the allocation continues until the server's resources are exhausted.
- The GitLab instance becomes unresponsive or crashes, which denies service to all legitimate users.
The specific endpoint paths and proof-of-concept payloads have not been disclosed. Both the HackerOne report (#3446641) and the GitLab work item (#584490) are currently restricted from public view. Under its standard disclosure policy, GitLab will make the issue details public on its issue tracker 30 days after the patch release.
Patch information
GitLab fixed CVE-2025-14870 in a coordinated patch release published on May 13, 2026. The release shipped three fixed versions across the supported release branches: 18.11.3, 18.10.6, and 18.9.7.
The fix adds proper input validation and resource consumption limits to the Duo Workflows API endpoint. Before the patch, a specially crafted JSON payload sent to this API could force the server to allocate memory or processing resources without any cap, which led to service degradation or an outright denial of service. The new bounds checking and validation logic rejects oversized or maliciously structured JSON bodies before they can trigger excessive resource consumption.
The vulnerability was introduced in GitLab version 18.5, the release that first shipped the Duo Workflows API, and it affected every later version up to, but not including, the patched releases. The three fixed versions correspond to the three currently supported GitLab release trains:
| Release branch | Vulnerable versions | Fixed version |
|---|---|---|
| 18.11.x | 18.11.0 through 18.11.2 | 18.11.3 |
| 18.10.x | 18.10.0 through 18.10.5 | 18.10.6 |
| 18.9.x and older | 18.5.0 through 18.9.6 | 18.9.7 |
The specific code changes are not publicly visible at this time. The associated GitLab work item remains private, and the HackerOne report is also restricted.
GitLab.com was already running the patched version at the time of disclosure, and GitLab Dedicated customers did not need to take any action. Self-managed installations should upgrade to one of the three fixed versions immediately. Security researcher a92847865 reported the vulnerability through GitLab's HackerOne bug bounty program.
Affected systems and versions
The vulnerability affects GitLab Community Edition (CE) and Enterprise Edition (EE) in the following version ranges:
- All versions from 18.5.0 up to (but not including) 18.9.7
- All versions from 18.10.0 up to (but not including) 18.10.6
- All versions from 18.11.0 up to (but not including) 18.11.3
The vulnerable component is the Duo Workflows API, first introduced in version 18.5. Any self-managed GitLab instance that runs a version in these ranges and exposes the Duo Workflows API to network traffic is affected. GitLab has already patched GitLab.com (SaaS) and GitLab Dedicated instances, and they require no customer action.
Vendor security history
GitLab has run a public bug bounty program on HackerOne since 2018. It sets bounty payouts with a public CVSS calculator, and payouts reach up to $1000 for critical- and high-severity reports upon triage. General DoS attacks are typically out of scope for the program, but GitLab explicitly makes an exception for application-layer DoS vulnerabilities that cause persistent, total service disruption and can be executed through unauthenticated endpoints. Accepting and fixing CVE-2025-14870 fits this updated policy and shows that GitLab is willing to address high-impact availability threats even when they fall into a category many bounty programs exclude.
References
- NVD: CVE-2025-14870
- CVE Record: CVE-2025-14870
- GitLab Patch Release: 18.11.3, 18.10.6, 18.9.7
- GitLab Release Announcement
- GitLab Work Item #584490 (restricted)
- HackerOne Report #3446641 (restricted)
- GitLab Bug Bounty Program Policy Updates
- GitLab on HackerOne
- CWE-770: Allocation of Resources Without Limits or Throttling
