Database/Control plane, storage & DevOps

GitLab: unauthenticated GraphQL requests exhaust resources through faulty complexity limits

CVSS 7.5CVE-2025-14871Control plane, storage & DevOps+1 more CVEscurated

Impact

Improper resource allocation limits in GitLab's GraphQL complexity calculation let an unauthenticated caller drive the instance into denial of service. GitLab assigned two ids for this in the same patch release with identical descriptions and version ranges (CVE-2026-1168 is the other, from a separate HackerOne report); an operator takes one action for both, so they are recorded together here. For a GPU fleet the cost is not the web UI but the CI/CD and GitOps path that hangs off it - image builds, model pipeline triggers and deploys stall while the instance is unavailable. Affects 18.4.6 up to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2.

Who can reach it

Anyone who can reach the GitLab GraphQL endpoint over the network, unauthenticated. Instances published to the internet are exposed directly; an instance restricted to an internal VLAN or behind SSO narrows this to that network.

What to do

Upgrade to GitLab 19.1.8, 19.2.6 or 19.3.2 and restart the application - a standard GitLab patch release with no node-level work. If the upgrade cannot land now, put rate limiting in front of the GraphQL endpoint and restrict unauthenticated access to it.

Also covers 1 CVE

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

CVE-2026-1168

References

https://nvd.nist.gov/vuln/detail/CVE-2025-14871 https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/https://gitlab.com/gitlab-org/gitlab/-/work_items/584492 https://nvd.nist.gov/vuln/detail/CVE-2026-1168

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.