GCVE-110-NCSC-2025-367

Advisory PublishedCVSS 7.8/10

Vulnetix · Advisory published November 18, 2025

GitLab has addressed a vulnerability in its CE/EE versions that allowed authenticated attackers to exploit specially crafted markdown content, potentially leading to a denial of service.

Download JSON Open in Console

Weaknesses (CWE)

CWE-416Use After FreeCWE-863Incorrect AuthorizationCWE-177Improper Handling of URL Encoding (Hex Encoding)CWE-789Memory Allocation with Excessive Size ValueCWE-201Insertion of Sensitive Information Into Sent DataCWE-862Missing AuthorizationCWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')

Risk Scores

CVSS 3.1

7.8/10

High · CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
GitLab	vers:unknown/*	—	—
Open Source	vers:unknown/*	—	—

Aliases

CVE-2024-55549 CVE-2025-11224 CVE-2025-11865 CVE-2025-11990 CVE-2025-12983 CVE-2025-24855 CVE-2025-2615 CVE-2025-6171 CVE-2025-6945 CVE-2025-7000 CVE-2025-7736

References

advisory

Browse GCVE Records

72,148 records in the GCVE database · Updated July 14, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON