Introduction
A single unauthenticated request can render a GitLab instance unresponsive if it exploits the right flaw. CVE-2025-8014 is a high-severity denial of service vulnerability in GitLab's GraphQL endpoints. It lets attackers bypass query complexity limits, which exhausts server resources and disrupts service. The issue affects a wide range of GitLab Community and Enterprise Edition deployments, so any organization that relies on GitLab for its software development lifecycle should treat it as a significant concern.
GitLab is a DevOps platform used by millions of developers and organizations worldwide. Teams of all sizes depend on its Community and Enterprise Editions for CI/CD, code management, and collaboration.
Technical Information
CVE-2025-8014 comes from a flaw in GitLab's GraphQL implementation. GitLab sets query complexity limits to prevent resource exhaustion, and unauthenticated users can bypass them. An attacker who crafts specific GraphQL queries can evade the built-in complexity analysis, and the backend then processes highly expensive operations without triggering the safeguards meant to stop them. The result can be excessive CPU and memory consumption and a denial of service for legitimate users.
The vulnerability is present in all GitLab EE/CE versions from 11.10 up to but not including 18.2.7, 18.3.3, and 18.4.1. The root cause is insufficient enforcement of query complexity thresholds in the GraphQL API, which lets certain queries slip past the checks. Exploitation requires no authentication, and that raises the risk.
No public code snippets or exploit examples are available as of this writing.
Patch Information
The vulnerability is fixed in the following GitLab versions:
- 18.4.1
- 18.3.3
- 18.2.7
The patch enforces query complexity thresholds in the GraphQL API more strictly, so resource-intensive queries are properly managed. Organizations running affected versions should upgrade to one of these releases immediately. The same patch release also fixes several other critical vulnerabilities, including XSS, privilege escalation, and additional DoS vectors. Full details are in the official advisory, GitLab Patch Release 18.4.1.
Affected Systems and Versions
- GitLab Community Edition (CE) and Enterprise Edition (EE)
- Versions from 11.10 up to but not including 18.2.7, 18.3.3, and 18.4.1
- All configurations exposing GraphQL endpoints are vulnerable
Vendor Security History
GitLab has a history of fixing critical vulnerabilities through coordinated patch releases. Recent advisories have included fixes for cross-site scripting, privilege escalation, and multiple denial of service issues. GitLab runs an active bug bounty program and typically responds quickly to reported vulnerabilities. It released the patches for CVE-2025-8014 rapidly.
