{"id":87048,"date":"2026-06-05T12:20:27","date_gmt":"2026-06-05T12:20:27","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-10858-denial-of-service-vulnerability-discovered-in-gitlab-ce-ee","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-10858-denial-of-service-vulnerability-discovered-in-gitlab-ce-ee\/","title":{"rendered":"CVE-2025-10858: Denial of Service Vulnerability Discovered in GitLab CE\/EE<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

An issue has been identified in GitLab CE\/EE, affecting multiple versions of the software, that allows unauthenticated users to initiate a Denial of Service (DoS) attack through the upload of large, specifically crafted JSON files. This vulnerability has significant implications as it can potentially compromise the system or lead to data leakage.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-10858
\nSeverity: High (7.5 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Denial of Service and potential system compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

GitLab CE | All versions before 18.2.7
\nGitLab EE | 18.3 before 18.3.3, 18.4 before 18.4.1<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability allows unauthenticated users to execute a Denial of Service attack by uploading large, specifically crafted JSON files. This exploit causes excessive resource consumption on the server, effectively causing a DoS condition. In some cases, this could potentially lead to a system compromise or data leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual example of how an attacker might exploit this vulnerability:<\/p>\n

POST \/upload_endpoint HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\n{ \"large_malicious_json\": \"...\" }<\/code><\/pre>\n
In this example, the attacker sends a POST request to the `\/upload_endpoint` of the target server, containing a large malicious JSON payload, causing the server to consume excessive resources and trigger a DoS condition.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview An issue has been identified in GitLab CE\/EE, affecting multiple versions of the software, that allows unauthenticated users to initiate a Denial of Service (DoS) attack through the upload of large, specifically crafted JSON files. This vulnerability has significant implications as it can potentially compromise the system or lead to data leakage. Vulnerability Summary […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-87048","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t