CVE-2025-3525

MEDIUM

GitLab CE/EE - DoS

Title source: llm

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have, under certain circumstances, allowed an authenticated user with certain access to cause Denial of Service by creating specially crafted CI triggers via the API.

References (3)

[Release Notes] https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/

[Issue Tracking] https://gitlab.com/gitlab-org/gitlab/-/issues/535662

[Third Party Advisory] https://hackerone.com/reports/3045257

Scores

CVSS v3 6.5

EPSS 0.0004

EPSS Percentile 12.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-770

Status published

Affected Products (4)

gitlab/gitlab < 18.7.5

gitlab/gitlab

Timeline

Published Feb 25, 2026

Tracked Since Feb 26, 2026