CVE-2025-8099

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.8 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions, could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 10.8, < 18.6.6; >= 18.7, < 18.7.4; >= 18.8, < 18.8.4

References

https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/557165Broken Link, Issue Tracking
https://hackerone.com/reports/3240210Permissions Required

Timeline

Published: Feb 11, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-81005.4The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' p CVE-2025-81018.8Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Ta CVE-2025-81025.4The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. Thi CVE-2025-81034.3The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.7.CVE-2025-81044.3The Memory Usage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.98. This is due to CVE-2025-81057.3The The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.6.7. This is due CVE-2025-81076.3In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executi CVE-2025-81086.7An ACAP configuration file has improper permissions and lacks input validation, which could potentially lead to privilege escalation. This v CVE-2025-81098.8Software installed and run as a non-privileged user may conduct ptrace system calls to issue writes to GPU origin read only memory.CVE-2025-81108.8Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.CVE-2025-81136.1The Ebook Store WordPress plugin before 5.8015 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribu CVE-2025-81144.7A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) proces