CVE-2025-1257

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-1257
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-1257.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-1257
Aliases
Published
2025-03-13T06:00:36.063Z
Modified
2026-04-10T05:20:57.939203Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Allocation of Resources Without Limits or Throttling in GitLab
Details

An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability in certain GitLab instances could allow an attacker to cause a denial of service condition by manipulating specific API inputs.

Database specific 
{
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1257.json",
    "cna_assigner": "GitLab"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
c5ab21eda575676ffc46b85cab3456473c0357c6
Fixed
14925e89dd8fcbadc4624ab451d64238cc651365
Database specific 
{
    "versions": [
        {
            "introduced": "12.3"
        },
        {
            "fixed": "17.7.7"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
f03594b9e09b648c839e9c008286a24c93c82373
Fixed
d7f0517433cc803ed10f8fed5b6b667d66f7a296
Database specific 
{
    "versions": [
        {
            "introduced": "17.8"
        },
        {
            "fixed": "17.8.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
f5041566b342c2f30a8d63b8117272c454e18410
Fixed
56dedd4cf9e7ce144b36c34ed45aa57355859659
Database specific 
{
    "versions": [
        {
            "introduced": "17.9"
        },
        {
            "fixed": "17.9.2"
        }
    ]
}

Affected versions

v17.*
v17.8.0-ee
v17.8.3-ee
v17.9.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-1257.json"