CVE-2025-3111: 
GitLab vulnerability analysis and mitigation

CVE-2025-3111 is a security vulnerability discovered in GitLab CE/EE affecting all versions from 10.2 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. The vulnerability was disclosed on May 22, 2025, and involves a lack of input validation in the Kubernetes integration functionality (NVD, GitLab Release).

The vulnerability stems from insufficient input validation in GitLab's Kubernetes integration component. It has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The weakness has been categorized as CWE-770 (Allocation of Resources Without Limits or Throttling) (NVD).

When exploited, this vulnerability allows an authenticated user to cause a denial of service condition in the GitLab instance. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (GitLab Release).

GitLab has released patches in versions 17.10.7, 17.11.3, and 18.0.1 to address this vulnerability. Users are strongly recommended to upgrade to these or later versions immediately. GitLab.com has already been updated with the security fix (GitLab Release).

The vulnerability was reported through GitLab's HackerOne bug bounty program by security researcher 'pwnie'. GitLab has classified this as a medium severity issue and included it in their scheduled security release (GitLab Release).