High severity7.5NVD Advisory· Published Oct 9, 2025· Updated Jun 17, 2026
CVE-2025-10004
CVE-2025-10004
Description
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
13cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 13.12
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=13.12.0,<18.2.8
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=13.12.0,<18.2.8
- osv-coords9 versionspkg:apk/chainguard/gitlab-rails-ce-18.1pkg:apk/chainguard/gitlab-rails-ce-assets-18.1pkg:apk/chainguard/gitlab-rails-ce-assets-fips-18.1pkg:apk/chainguard/gitlab-rails-ce-doc-18.1pkg:apk/chainguard/gitlab-rails-ce-doc-fips-18.1pkg:apk/chainguard/gitlab-rails-ce-fips-18.1pkg:apk/chainguard/gitlab-workhorse-ce-18.1pkg:apk/chainguard/gitlab-workhorse-ce-fips-18.1pkg:bitnami/gitlab
< 18.1.6-r3+ 8 more
- (no CPE)range: < 18.1.6-r3
- (no CPE)range: < 18.1.6-r3
- (no CPE)range: < 18.1.6-r4
- (no CPE)range: < 18.1.6-r3
- (no CPE)range: < 18.1.6-r4
- (no CPE)range: < 18.1.6-r4
- (no CPE)range: < 18.1.6-r3
- (no CPE)range: < 18.1.6-r4
- (no CPE)range: >= 13.12.0, < 18.2.8
- Range: from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2
Patches
Vulnerability mechanics
References
3- about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/nvdRelease NotesVendor Advisory
- gitlab.com/gitlab-org/gitlab/-/issues/568121nvdBroken Link
- hackerone.com/reports/3026555nvdPermissions Required
News mentions
1- GitLab Patch Release: 18.4.2, 18.3.4, 18.2.8GitLab Security Releases · Oct 8, 2025