CVE-2025-12664
Published: 08 April 2026
Summary
CVE-2025-12664 is a high-severity Improper Validation of Specified Quantity in Input (CWE-1284) vulnerability in Gitlab Gitlab. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 18.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-12664 is a denial-of-service vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE), affecting all versions from 13.0 prior to 18.8.9, 18.9 prior to 18.9.5, and 18.10 prior to 18.10.3. The flaw enables an unauthenticated user to trigger a DoS condition by sending repeated GraphQL queries, leading to resource exhaustion. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and maps to CWE-1284 (Improper Validation of Specified Index or Position).
An unauthenticated attacker with network access can exploit this vulnerability by repeatedly submitting GraphQL queries to the GitLab instance. Successful exploitation results in denial of service through high resource consumption, with no requirements for privileges or user interaction and no impact on confidentiality or integrity.
GitLab has remediated the issue with patches in versions 18.8.9, 18.9.5, and 18.10.3. Administrators should upgrade affected instances to these versions or later to mitigate the vulnerability, as detailed in the official patch release notes, associated GitLab work item, and HackerOne disclosure report.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209365
Vulnerability details
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables application-level DoS via unauthenticated GraphQL query abuse leading to resource exhaustion (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Denial-of-service protection directly prevents resource exhaustion from repeated unauthenticated GraphQL queries via mechanisms like rate limiting.
Flaw remediation requires patching the specific GraphQL vulnerability in GitLab to eliminate the DoS condition.
Information input validation mitigates improper validation of GraphQL queries (CWE-1284) that enables resource exhaustion.