CVE-2025-2614: 
GitLab vulnerability analysis and mitigation

An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an authenticated user to cause a denial of service condition by creating specially crafted content that consumes excessive server resources when processed. The vulnerability was assigned CVE-2025-2614 and was reported through GitLab's HackerOne bug bounty program (GitLab Release, NVD).

The vulnerability is classified as an Allocation of Resources Without Limits or Throttling issue (CWE-770). It received a CVSS v3.1 base score of 6.5 MEDIUM with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating network accessibility, low attack complexity, and requiring low privileges with no user interaction (GitLab Release).

The vulnerability could allow an authenticated user to cause a denial of service condition by creating specially crafted content that consumes excessive server resources when processed. This could potentially affect the availability of the GitLab instance (GitLab Release).

GitLab has released patches in versions 18.0.6, 18.1.4, and 18.2.2 to address this vulnerability. It is strongly recommended that all affected installations be upgraded to one of these patched versions immediately. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action (GitLab Release).