CVE-2025-10868: 
GitLab vulnerability analysis and mitigation

A Denial of Service vulnerability (CVE-2025-10868) has been discovered in GitLab CE/EE affecting all versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. The vulnerability involves performance degradation with large inputs in certain string conversion methods (GitLab Release, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 3.5 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L. The issue is related to string conversion methods that exhibit performance degradation when processing large inputs. It has been classified under CWE-840 (Business Logic Errors) (GitLab Release).

When exploited, this vulnerability could allow an authenticated user to cause performance degradation, potentially leading to a Denial of Service condition through the manipulation of string conversion methods (GitLab Release).

GitLab has released patches to address this vulnerability in versions 18.2.7, 18.3.3, and 18.4.1. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take any action (GitLab Release).