{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13929", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2025-12-02T21:33:14.522Z", "datePublished": "2026-03-11T16:05:35.672Z", "dateUpdated": "2026-03-12T16:20:28.038Z"}, "containers": {"cna": {"title": "Allocation of Resources Without Limits or Throttling in GitLab", "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certain conditions."}], "affected": [{"vendor": "GitLab", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "versions": [{"version": "10.0", "status": "affected", "lessThan": "18.7.6", "versionType": "semver"}, {"version": "18.8", "status": "affected", "lessThan": "18.8.6", "versionType": "semver"}, {"version": "18.9", "status": "affected", "lessThan": "18.9.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "cweId": "CWE-770", "type": "CWE"}]}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/582738", "name": "GitLab Issue #582738", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/3441004", "name": "HackerOne Bug Bounty Report #3441004", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/582738"}, {"url": "https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.7.6, 18.8.6, 18.9.2 or above."}], "credits": [{"lang": "en", "value": "Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program", "type": "finder"}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-03-11T16:05:35.672Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T15:42:12.319805Z", "id": "CVE-2025-13929", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T16:20:28.038Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13929", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T15:42:12.319805Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T15:42:18.724Z"}}], "cna": {"title": "Allocation of Resources Without Limits or Throttling in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "10.0", "lessThan": "18.7.6", "versionType": "semver"}, {"status": "affected", "version": "18.8", "lessThan": "18.8.6", "versionType": "semver"}, {"status": "affected", "version": "18.9", "lessThan": "18.9.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 18.7.6, 18.8.6, 18.9.2 or above."}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/582738", "name": "GitLab Issue #582738", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/3441004", "name": "HackerOne Bug Bounty Report #3441004", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/582738"}, {"url": "https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/"}], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certain conditions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-03-11T16:05:35.672Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13929", "state": "PUBLISHED", "dateUpdated": "2026-03-12T16:20:28.038Z", "dateReserved": "2025-12-02T21:33:14.522Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-03-11T16:05:35.672Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "E552588B-B0F4-40F4-98FD-394F30ABFE22", "versionEndExcluding": "18.7.6", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "85D6F660-B145-4890-AE32-F4FEFDE35C98", "versionEndExcluding": "18.7.6", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "B703CB01-7F6D-4D6E-AE88-CF2F8012CA27", "versionEndExcluding": "18.8.6", "versionStartIncluding": "18.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "2B1F834B-A628-4894-A531-1A2A60DD58D7", "versionEndExcluding": "18.8.6", "versionStartIncluding": "18.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "44EAE9A6-5ED9-42F6-9BBD-0E2F8072F0D9", "versionEndExcluding": "18.9.2", "versionStartIncluding": "18.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "12A2DEC0-C471-4C98-960C-405209403AB9", "versionEndExcluding": "18.9.2", "versionStartIncluding": "18.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certain conditions."}], "id": "CVE-2025-13929", "lastModified": "2026-03-13T12:33:51.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "cve@gitlab.com", "type": "Secondary"}]}, "published": "2026-03-11T16:16:19.043", "references": [{"source": "cve@gitlab.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/"}, {"source": "cve@gitlab.com", "tags": ["Broken Link"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/582738"}, {"source": "cve@gitlab.com", "tags": ["Broken Link"], "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/582738"}, {"source": "cve@gitlab.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/3441004"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "cve@gitlab.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0,18.7.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.8,18.8.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.9,18.9.2)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "GitLab", "source": "cna", "vendor": "GitLab"}, "product": "gitlab", "vendor": "gitlab"}], "analysis": {"en": {"generated_at": "2026-03-17T14:43:53.181798+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch by upgrading to GitLab version 18.7.6, 18.8.6, 18.9.2 or later."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "All instances of GitLab CE and EE that have not applied the corrective upgrade are affected. Specifically, every released version between 10.0 and 18.9.1 is impacted. GitLab CE and EE deployments must evaluate whether they are running a vulnerable version and apply the patch accordingly.", "description_and_impact": "GitLab\u2019s repository archive endpoint processes specially crafted requests that can cause resource exhaustion, enabling an unauthenticated attacker to trigger a denial\u2011of\u2011service (DoS). The flaw stems from insufficient limits on resource allocation during archive generation, classified as CWE\u2011770. Once exploited, the affected system can become unresponsive, denying legitimate users access to the platform. The vulnerability affects all GitLab Community Edition (CE) and Enterprise Edition (EE) releases from v10.0 up to but excluding v18.7.6, v18.8.6, and v18.9.2, meaning that the majority of installations older than these patches are at risk.", "risk_and_exploitability": "The CVSS score of 7.5 indicates high severity, and while the EPSS score is below 1%, indicating a low current exploit probability, the lacking presence in the CISA KEV catalog does not preclude potential use by attackers. Because the bug can be triggered by unauthenticated web requests, it is remotely exploitable over the network. Successful exploitation results in service disruption, making this a high priority to remediate."}}}}, "created": "2026-03-12T09:58:08.852800+00:00", "updated": "2026-03-20T15:30:44.743552+00:00", "vendors": ["gitlab", "gitlab$PRODUCT$gitlab"]}