CVE-2025-7449
Allocation of Resources Without Limits or Throttling in GitLab
Reported by gitlab · Published November 26, 2025
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user with specific permissions to cause a denial of service condition through HTTP response processing.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| gitlab-rails-ce-18.2 | Chainguard | 18.2.8-r3 |
| gitlab-rails-ce-18.3 | Chainguard | 18.3.6-r2 |
| gitlab-rails-ce-fips-18.2 | Chainguard | 18.2.8-r4 |
| gitlab-rails-ce-fips-18.3 | Chainguard | 18.3.6-r2 |
| gitlab-workhorse-ce-18.2 | Chainguard | 18.2.8-r3 |
| gitlab-rails-ce-fips-18.1 | Chainguard | 18.1.6-r4 |
| gitlab-workhorse-ce-fips-18.1 | Chainguard | 18.1.6-r4 |
| gitlab-rails-ce-18.1 | Chainguard | 18.1.6-r3 |
| gitlab | Bitnami | 18.6.1, 18.5.3, 18.4.5 |
| gitlab-workhorse-ce-18.3 | Chainguard | 18.3.6-r2 |
| gitlab-workhorse-ce-fips-18.2 | Chainguard | 18.2.8-r3 |
| gitlab-workhorse-ce-18.1 | Chainguard | 18.1.6-r3 |
2 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| GitLab | GitLab | 8.3, 18.5, 18.6 |
| chainguard | gitlab-rails-ce-18.2 | 0 |
| chainguard | gitlab-rails-ce-18.3 | 0 |
| chainguard | gitlab-rails-ce-fips-18.2 | 0 |
| chainguard | gitlab-rails-ce-fips-18.3 | 0 |
| chainguard | gitlab-workhorse-ce-18.2 | 0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| chainguard | gitlab-workhorse-ce-fips-18.1 | 0 |
| chainguard | gitlab-rails-ce-18.1 | 0 |
| GitLab | GitLab | 18.6, 8.3, 18.5 |
| chainguard | gitlab-workhorse-ce-18.3 | 0 |
| chainguard | gitlab-workhorse-ce-fips-18.2 | 0 |
| chainguard | gitlab-workhorse-ce-18.1 | 0 |
Timeline
- Nov 26, 2025 CVE Published
- Nov 27, 2025 EPSS Score (30 in total, the first dated here)
- Mar 17, 2026 Security Advisory (3 in total, the first dated here)
- Mar 26, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-7449
vulnetix vdb fixes CVE-2025-7449Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-7449/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- GitLab Security Release Blog Post vendor-advisory
- GitLab Issue #554938 issue-trackingpermissions-required
- HackerOne Bug Bounty Report #3215054 technical-descriptionexploitpermissions-required