Introduction
A single crafted JSON file can make a GitLab instance unresponsive and stall the development and deployment pipelines of the entire organization that depends on it. CVE-2025-10858 is a denial of service flaw in GitLab's file upload handling. It affects a wide range of versions, and exploiting it requires no authentication.
GitLab is a DevSecOps platform with millions of users worldwide. Teams run source code management, CI/CD, and collaborative software development through it, so a vulnerability like this one has a broad and immediate operational impact.
Technical Information
CVE-2025-10858 is a denial of service vulnerability classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The flaw is in the JSON file upload processing logic of GitLab Community Edition and Enterprise Edition. An attacker uploads a specially crafted JSON file, and parsing it consumes excessive resources. The file can contain deeply nested objects, large arrays, or repetitive structures that make the backend allocate excessive memory or CPU cycles.
Exploitation requires no authentication. Any unauthenticated user who can reach a vulnerable GitLab instance can submit a malicious JSON file through its upload interfaces, which can leave the GitLab service unresponsive for all users. The attack surface includes any endpoint or feature that accepts JSON file uploads, so public-facing instances are especially at risk.
No public code snippets or proof-of-concept details are available for this vulnerability. The root cause is that GitLab lacks sufficient resource allocation controls and input validation when it processes JSON files.
Patch Information
The vulnerability is fixed in the following GitLab versions:
- 18.4.1
- 18.3.3
- 18.2.7
The patch adds stricter validation and sanitization of JSON file uploads, so GitLab processes only properly formatted, safe JSON files. Administrators of self-managed GitLab should upgrade to one of these versions using the official upgrade paths. GitLab.com and GitLab Dedicated users are already protected.
Reference: GitLab 18.4.1 Patch Release
Affected Systems and Versions
- GitLab Community Edition (CE) and Enterprise Edition (EE)
- All versions before 18.2.7
- 18.3 before 18.3.3
- 18.4 before 18.4.1
Any configuration that runs one of the affected versions and has JSON file upload capability is vulnerable.
Vendor Security History
GitLab has previously fixed several denial of service and resource exhaustion vulnerabilities, including issues in diff processing, runner description fields, and artifact handling. GitLab ships patches on a regular schedule and has responded quickly to critical vulnerabilities. It runs a public bug bounty program and publishes transparent security advisories.
