CVE-2025-13335: 
GitLab vulnerability analysis and mitigation

CVE-2025-13335 is an infinite loop (denial of service) vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) affecting the Wiki redirect functionality. An authenticated user can craft malformed Wiki documents that bypass cycle detection, triggering an infinite loop and causing a denial of service condition. The vulnerability affects all GitLab CE/EE versions from 17.1 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2. It was disclosed on January 22, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitLab Advisory, Red Hat CVE).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). The vulnerability exists in GitLab's Wiki redirect processing, where the cycle detection mechanism can be bypassed by specially crafted malformed Wiki documents. An authenticated attacker with low privileges can configure such documents to cause the server to enter an infinite loop during Wiki page resolution, exhausting server resources. The attack is network-based, requires no user interaction, and has low attack complexity. The vulnerability was reported through HackerOne by researcher sim4n6 (GitLab Advisory).

Successful exploitation results in a denial of service, making the affected GitLab instance unavailable to legitimate users. The impact is limited to availability — there is no confidentiality or integrity impact, as the vulnerability does not expose data or allow unauthorized modifications. Because the attack requires only authenticated access (any low-privileged user), it presents a meaningful risk in multi-tenant or open-registration GitLab deployments where service continuity is critical (GitLab Advisory, Red Hat CVE).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.016% (0.000160), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Red Hat CVE).

1. Authentication: Log in to a vulnerable GitLab instance (versions 17.1 through 18.6.3, 18.7.0–18.7.1, or 18.8.0–18.8.1) with any valid user account.
2. Identify a Wiki-enabled project: Navigate to or create a project with Wiki functionality enabled.
3. Create malformed Wiki documents: Craft Wiki pages with redirect configurations that form a circular reference structure designed to bypass GitLab's cycle detection logic (e.g., Page A redirects to Page B, which redirects back to Page A, with additional obfuscation to evade detection).
4. Trigger the infinite loop: Access or cause the server to process the malformed Wiki redirect chain, causing the Wiki rendering engine to enter an infinite loop.
5. Denial of service achieved: The server process consumes excessive CPU/memory resources, degrading or completely disrupting GitLab service availability for all users (GitLab Advisory).

• Logs: Unusual or repeated GitLab application log entries related to Wiki page rendering or redirect resolution; stack traces or timeout errors in production.log associated with Wiki processing.
• Process/Resource: Sustained high CPU or memory utilization by GitLab Puma/Unicorn worker processes without corresponding legitimate traffic spikes; worker processes becoming unresponsive.
• Network: Repeated HTTP requests from a single authenticated user to Wiki endpoints (e.g., /[namespace]/[project]/-/wikis/) with unusual page names or redirect parameters.
• Application: GitLab service becoming unavailable or returning 503 errors shortly after Wiki document creation or modification by a specific user account.

GitLab has released patched versions addressing this vulnerability: upgrade to 18.6.4 (for versions 17.1–18.6.3), 18.7.2 (for versions 18.7.0–18.7.1), or 18.8.2 (for versions 18.8.0–18.8.1). GitLab.com and GitLab Dedicated customers are already protected. As a workaround, administrators should restrict Wiki editing permissions to trusted users only, and monitor GitLab service health and resource utilization for anomalies. Implementing rate limiting on Wiki document creation and modification operations can also reduce risk (GitLab Advisory).

The vulnerability received moderate coverage in the security community, primarily in the context of the broader January 2026 GitLab patch release that also addressed a higher-severity 2FA bypass (CVE-2026-0723). Coverage from outlets such as BleepingComputer, The Hacker News, and SecurityOnline highlighted the patch release, with most attention focused on the 2FA bypass rather than this DoS issue. GitLab's official advisory emphasized immediate upgrading for all self-managed installations (BleepingComputer, The Hacker News, GitLab Advisory).