CVE-2025-10004

HighCVSS 7.5/10Last modified Oct 19, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 13.12, < 18.2.8; >= 18.3, < 18.3.4; >= 18.4, < 18.4.2

References

https://about.gitlab.com/releases/2025/10/08/patch-release-gitlab-18-4-2-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/568121Broken Link
https://hackerone.com/reports/3026555Permissions Required

Timeline

Published: Oct 9, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-100054.3The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Refere CVE-2025-100065.4The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rev_slider_vc' shortcode in al CVE-2025-100085.3The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabi CVE-2025-100098.6Incorrect handling of uploaded files in the admin "Restore" function in Invoice Ninja <= 5.11.72 allows attackers with admin credentials to CVE-2025-10015.7Medixant RadiAnt DICOM Viewer is vulnerable due to failure of the update mechanism to verify the update server's certificate which could all CVE-2025-100106.8The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before using BitLocker to dec CVE-2025-100118.8A weakness has been identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/TabelaArre CVE-2025-100128.8A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file educar CVE-2025-100136.3A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Perform CVE-2025-100143.1A flaw has been found in elunez eladmin up to 2.7. This impacts the function updateUserEmail of the file /api/users/updateEmail/ of the comp CVE-2025-100154.8The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A loca CVE-2025-100168.8The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker