GitLab Urges Immediate Update for Two High-Severity Flaws

GitLab has released new versions of its Community and Enterprise Editions to address several security vulnerabilities, including two critical flaws that could be exploited to disrupt services and compromise data.

High-Severity Vulnerabilities

• CVE-2025-2256: Denial of Service in SAML Responses
  This vulnerability could allow an unauthenticated user to make a GitLab instance unresponsive by sending multiple large SAML responses concurrently. The flaw has been assigned a CVSS score of 7.5. The affected versions include all versions of GitLab CE/EE from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2.
• CVE-2025-6454: Server-Side Request Forgery in Webhook Custom Headers
  This issue could allow an authenticated user to make unintended internal requests within a proxy environment. Attackers could inject crafted sequences into webhook custom headers to exploit this vulnerability. This flaw has a CVSS score of 8.5. All versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 are affected.

Additional Security Fixes

• CVE-2025-1250: A Denial of Service flaw impacting user-controllable fields, where a specially crafted commit message, merge request description, or note could stall background jobs. The CVSS score is 6.5. This affects all versions from 15.0 before the patched versions.
• CVE-2025-7337: A Denial of Service issue in endpoint file uploads. An authenticated user with Developer-level access could cause a persistent denial of service by uploading large files. The CVSS score is 6.5. This affects all versions from 7.8 before the patched versions.
• CVE-2025-10094: A Denial of Service vulnerability in token listing operations. Authenticated users could create tokens with excessively large names, disrupting access to administrative operations. The CVSS score is 6.5. This affects all versions from 10.7 before the patched versions.
• CVE-2025-6769: An information disclosure issue in runner endpoints. Authenticated users could view administrator-only maintenance notes by accessing runner details through specific interfaces. The CVSS score is 4.3. This affects all versions from 15.1 before the patched versions.

All self-managed GitLab installations are strongly advised to upgrade immediately to versions 18.3.2, 18.2.6, or 18.1.6 to mitigate these risks.

Related Posts:

• GitLab Releases Security Updates: XSS and Authorization Bypass Flaws Patched
• GitLab Patches High-Severity Flaws: Update Now to Prevent XSS and Account Takeover
• GitLab Releases Security Update to Patch XSS and Account Takeover Flaws
• GitLab Update: High-Severity XSS & Data Exposure Flaws Patched

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.