CVE-2025-14511

HIGH

GitLab 12.2-18.7.4, 18.8-18.8.4, 18.9-18.9.0 - Unauthenticated Denial of Service via Container Registry Event Endpoint

Title source: llm
STIX 2.1

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.2 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted files to the container registry event endpoint under certain conditions.

References (3)

Core 3
Core References
Issue Tracking issue-tracking permissions-required
https://gitlab.com/gitlab-org/gitlab/-/issues/583717
Third Party Advisory technical-description exploit permissions-required
https://hackerone.com/reports/3452200

Scores

CVSS v3 7.5
EPSS 0.0036
EPSS Percentile 27.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-1284
Status published
Products (2)
gitlab/gitlab 18.9.0 (2 CPE variants)
gitlab/gitlab 12.2.0 - 18.7.5 (2 CPE variants)
Published Feb 25, 2026
Tracked Since Feb 26, 2026