Cloudanix VulnDB

CVE-2025-11447

High · 7.5

CVSS

7.5

EPSS

0.8%

Published

Oct 27, 2025

CISA due date

—

The record

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending GraphQL requests with crafted JSON payloads.

Affected packages

Ecosystem Package Introduced Fixed
Bitnami gitlab 11.0.0 18.3.5
Chainguard gitlab-rails-ce-18.1 0 18.1.6-r3
Chainguard gitlab-rails-ce-18.2 0 18.2.8-r3
Chainguard gitlab-rails-ce-assets-18.1 0 18.1.6-r3
Chainguard gitlab-rails-ce-assets-18.2 0 18.2.8-r3
Chainguard gitlab-rails-ce-assets-fips-18.1 0 18.1.6-r4
Chainguard gitlab-rails-ce-assets-fips-18.2 0 18.2.8-r4
Chainguard gitlab-rails-ce-doc-18.1 0 18.1.6-r3
Chainguard gitlab-rails-ce-doc-18.2 0 18.2.8-r3
Chainguard gitlab-rails-ce-doc-fips-18.1 0 18.1.6-r4
Chainguard gitlab-rails-ce-doc-fips-18.2 0 18.2.8-r4
Chainguard gitlab-rails-ce-fips-18.1 0 18.1.6-r4
Chainguard gitlab-rails-ce-fips-18.2 0 18.2.8-r4
Chainguard gitlab-workhorse-ce-18.1 0 18.1.6-r3
Chainguard gitlab-workhorse-ce-18.2 0 18.2.8-r3
Chainguard gitlab-workhorse-ce-fips-18.1 0 18.1.6-r4
Chainguard gitlab-workhorse-ce-fips-18.2 0 18.2.8-r3

Related vulnerabilities