GitLab has released new versions of its Community and Enterprise Editions to address several security vulnerabilities, including two critical flaws that could be exploited to disrupt services and compromise data.
High-Severity Vulnerabilities
- CVE-2025-2256: Denial of Service in SAML Responses
This vulnerability could allow an unauthenticated user to make a GitLab instance unresponsive by sending multiple large SAML responses concurrently. The flaw has been assigned a CVSS score of 7.5. The affected versions include all versions of GitLab CE/EE from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2. - CVE-2025-6454: Server-Side Request Forgery in Webhook Custom Headers
This issue could allow an authenticated user to make unintended internal requests within a proxy environment. Attackers could inject crafted sequences into webhook custom headers to exploit this vulnerability. This flaw has a CVSS score of 8.5. All versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 are affected.
Additional Security Fixes
- CVE-2025-1250: A Denial of Service flaw impacting user-controllable fields, where a specially crafted commit message, merge request description, or note could stall background jobs. The CVSS score is 6.5. This affects all versions from 15.0 before the patched versions.
- CVE-2025-7337: A Denial of Service issue in endpoint file uploads. An authenticated user with Developer-level access could cause a persistent denial of service by uploading large files. The CVSS score is 6.5. This affects all versions from 7.8 before the patched versions.
- CVE-2025-10094: A Denial of Service vulnerability in token listing operations. Authenticated users could create tokens with excessively large names, disrupting access to administrative operations. The CVSS score is 6.5. This affects all versions from 10.7 before the patched versions.
- CVE-2025-6769: An information disclosure issue in runner endpoints. Authenticated users could view administrator-only maintenance notes by accessing runner details through specific interfaces. The CVSS score is 4.3. This affects all versions from 15.1 before the patched versions.
All self-managed GitLab installations are strongly advised to upgrade immediately to versions 18.3.2, 18.2.6, or 18.1.6 to mitigate these risks.
