GitLab has released emergency security updates for Community ( CE) and Enterprise (EE) editions , addressing multiple vulnerabilities, including two serious ones that could lead to Server-Side Request Forgery (SSRF) and Denial of Service (DoS) attacks.
The company urges all administrators of self-managed GitLab installations to immediately upgrade to the new versions: 18.3.2, 18.2.6 and 18.1.6.
The updates address a total of six security vulnerabilities. Customers using the GitLab.com cloud service are already protected, while GitLab Dedicated users do not need to take any action.
GitLab: Fix vulnerabilities
The most critical vulnerabilities fixed in this release are an SSRF flaw and a DoS issue .
See also: Sophos Wireless Access Points: Vulnerability Fix
The SSRF vulnerability, tracked as CVE-2025-6454, has a CVSS score of 8.5. It is located in the Webhook custom header feature and could be exploited by an authorized user. By injecting specially crafted sequences, an attacker could force GitLab to make unwanted internal requests within proxy environments, potentially leading to further compromise.
This flaw affects all versions from 16.11 to the latest fixed versions.
The second high-severity issue, CVE-2025-2256, is a DoS vulnerability with a CVSS score of 7.5. An unauthenticated attacker could exploit this flaw by sending multiple significant SAML responses to a GitLab installation at the same time. In doing so, they overload its resources and render it unresponsive to legitimate users. This vulnerability has a broad impact, affecting all versions since 7.12.
In addition to the high severity issues, GitLab fixed four medium severity vulnerabilities, three of which could also lead to denial of service.
CVE-2025-1250: A DoS flaw (CVSS 6.5), where an authenticated user could delay the processing of background jobs using specially crafted commit messages or merge request descriptions.
CVE-2025-7337: A DoS vulnerability (CVSS 6.5) that allows an authenticated user with Developer-level access to crash a GitLab installation by uploading large files.
CVE-2025-10094: Another DoS issue (CVSS 6.5) that allows authenticated users to disrupt access to token-related operations by creating tokens with excessively long names.
CVE-2025-6769: An information disclosure vulnerability (CVSS 4.3) that could allow an authenticated user to view administrator-only maintenance notes, gaining access to runner details via specific interfaces.
See also: Chrome update fixes critical RCE vulnerability
GitLab has credited several security researchers, yuki_osaki, ppee, pwnie, and iamgk808, for discovering and reporting these vulnerabilities through bug bounty program . In accordance with its disclosure policy, full details of these vulnerabilities will be made public on GitLab's issue tracker 30 days after release.
The company has urged all self-managed customers to review the security announcement and apply the updates to protect their installations from possible attacks.
The risks to digital systems are constantly increasing
GitLab’s new updates aren’t just a typical “bug fix.” They’re a clear wake-up call for organizations that manage their own deployments. The two serious vulnerabilities –SSRF and DoS– show how vulnerable critical software development platforms can become when malicious users have the right tools in their hands.
The SSRF case is of particular interest, as it reveals how a seemingly small feature, such as custom headers in webhooks, can be turned into a vehicle for internal attacks. On the other hand, the DoS scenario with SAML responses highlights the risk that arises when a service is not designed to withstand targeted loads.
See also: Microsoft Patch Tuesday September 2025: 81 Vulnerabilities Fixed
GitLab's warning fits into a broader context: collaboration and DevOps platforms are now essential parts of the software supply chain, and therefore attractive targets. Prompt patching is not just a recommendation; it is a critical measure to prevent the collapse of entire development cycles.
