CVE-2025-8014

{
  "id": "CVE-2025-8014",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-27T17:15:33.987",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Denial of Service issue in GraphQL endpoints in Gitlab EE/CE affecting all versions from 11.10 prior to 18.2.7, 18.3 prior to 18.3.3, and 18.4 prior to 18.4.1 allows unauthenticated users to potentially bypass query complexity limits leading to resource exhaustion and service disruption."
    },
    {
      "lang": "es",
      "value": "Problema de denegación de servicio en los puntos finales de GraphQL en Gitlab EE/CE que afecta a todas las versiones desde la 11.10 anteriores a la 18.2.7, la 18.3 anteriores a la 18.3.3, y la 18.4 anteriores a la 18.4.1 permite a usuarios no autenticados potencialmente eludir los límites de complejidad de las consultas, lo que lleva al agotamiento de recursos y a la interrupción del servicio."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "GitLab",
          "product": "GitLab",
          "defaultStatus": "unaffected",
          "cpes": [
            "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
          ],
          "repo": "git://[email protected]:gitlab-org/gitlab.git",
          "versions": [
            {
              "version": "11.10",
              "lessThan": "18.2.7",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "18.3",
              "lessThan": "18.3.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "18.4",
              "lessThan": "18.4.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-30T17:27:09.194434Z",
          "id": "CVE-2025-8014",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
              "versionStartIncluding": "11.10.0",
              "versionEndExcluding": "18.2.7",
              "matchCriteriaId": "93BFA3A3-74FF-4A3C-A852-47222A68EEB4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
              "versionStartIncluding": "11.10.0",
              "versionEndExcluding": "18.2.7",
              "matchCriteriaId": "318545D2-1C74-4698-8414-212C8D6BA4BF"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
              "versionStartIncluding": "18.3.0",
              "versionEndExcluding": "18.3.3",
              "matchCriteriaId": "75F843E1-B1EB-44F7-9966-9874F512A487"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
              "versionStartIncluding": "18.3.0",
              "versionEndExcluding": "18.3.3",
              "matchCriteriaId": "FEDB2960-F05D-4510-ACD3-05F16E621C6B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:gitlab:gitlab:18.4.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "C0DA83D6-F16D-47B4-B817-1591FB60E5E6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:gitlab:gitlab:18.4.0:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "6976AFEA-CD46-41A2-B52D-67FA8D4481D5"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/556838",
      "source": "[email protected]",
      "tags": [
        "Broken Link"
      ]
    },
    {
      "url": "https://hackerone.com/reports/3228134",
      "source": "[email protected]",
      "tags": [
        "Permissions Required"
      ]
    }
  ]
}