Introduction
When a source code management platform goes down, entire engineering teams can stall and critical deployments can slip. CVE-2025-11447, a denial-of-service vulnerability in GitLab's GraphQL API, was disclosed and patched in October 2025. It affects a wide range of GitLab Community Edition and Enterprise Edition versions. GitLab is a DevSecOps platform for source code management, CI/CD, and collaboration, used by startups, enterprises, and open source projects worldwide, so a flaw in one of its core services reaches a lot of teams.
Technical information
CVE-2025-11447 is a denial-of-service vulnerability in GitLab's GraphQL API. The flaw is in the JSON validation logic that processes incoming GraphQL requests, and it affects all GitLab CE/EE versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1. An unauthenticated attacker can send specially crafted JSON payloads to the GraphQL endpoint, which triggers excessive resource consumption and makes the GitLab instance unresponsive.
The root cause is that the JSON validation routines do not limit or throttle the resources they allocate. Given a maliciously structured JSON payload, the validation logic tries to process it without enough checks on size, nesting, or complexity. CPU and memory use then grows without control until the instance can no longer serve requests. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).
No public code snippets for the vulnerable implementation have been released. The attack needs no authentication, and the GraphQL endpoint is usually reachable over the network, so exploitation is straightforward for a remote attacker.
Patch information
The GitLab 18.5.1 release fixed several critical security vulnerabilities, including this one.
Denial of Service in JSON Validation (CVE-2025-11447): Unauthenticated users could cause a DoS condition by sending GraphQL requests with crafted JSON payloads. The patch adds stricter JSON schema validation to the GraphQL API, so incoming requests must match the expected structures and data types. This stops malformed requests from affecting system availability.
Upgrade to version 18.5.1 to get these fixes.
Patch reference: GitLab 18.5.1 Security Release
Affected systems and versions
- GitLab Community Edition (CE) and Enterprise Edition (EE) versions 11.0 before 18.3.5
- Versions 18.4 before 18.4.3
- Versions 18.5 before 18.5.1
Any deployment of these versions is affected if its GraphQL API is exposed.
Vendor security history
GitLab has fixed similar denial-of-service vulnerabilities in its API and GraphQL implementations before. CVE-2025-10004 involved the GraphQL blob type, for example, and CVE-2025-10497 affected event collection. GitLab ships security patches on a regular cadence and runs a public bug bounty program, and most critical vulnerabilities are patched within scheduled release cycles. CVE-2025-11447 went through the same standard process, with coordinated disclosure and a timely patch release.
