Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

Multiple GitLab Vulnerabilities Let Attackers Trigger DoS Attacks

GitLab has issued security updates for its Community Edition (CE) and Enterprise Edition (EE) platforms, addressing 11 vulnerabilities. The updates include critical patches for high-risk flaws that enable denial-of-service (DoS) attacks .

MBy Michael ReevesMay 23, 20252 min read

GitLab has issued security updates for its Community Edition (CE) and Enterprise Edition (EE) platforms, addressing 11 vulnerabilities. The updates include critical patches for high-risk flaws that enable denial-of-service (DoS) attacks .

These updates, released in versions 18.0.1, 17.11.3, and 17.10.7, aim to mitigate various attack vectors that could compromise system stability through resource exhaustion, authentication bypasses, and data exposure risks.

This update affects all deployment models, including omnibus, source code, and helm chart installations. GitLab recommends immediate upgrades for all self-managed installations, noting that GitLab.com already operates on the patched version.

Critical Large Blob Endpoint Vulnerability

The most critical vulnerability (CVE-2025-0993) allows authenticated attackers to exhaust server resources via an unprotected large blob endpoint, with a CVSS v3.1 score of 7.5. This flaw affects all installations before the patched versions, enabling attackers to overload systems by submitting oversized data payloads.

A git blob (binary large object) stores the contents of each file in a repository. The vulnerability exploits GitLab's handling of blobs larger than 10 MB, which are currently limited to 5 requests per minute. This vulnerability could lead to prolonged downtime in unprotected environments.

GitLab has issued security updates for its Community Edition (CE) and Enterprise Edition (EE) platforms, addressing 11 vulnerabilities.
Michael Reeves · Thehackingpost

Medium-Severity DoS Attack Vectors Patched

Additional medium-severity DoS vectors addressed in this release include:

CVE-2025-3111 (CVSS 6.5): Unbounded Kubernetes cluster tokens could result in DoS due to lack of input validation, allowing authenticated users to generate excessive tokens. CVE-2025-2853 (CVSS 6.5): Unvalidated notes position may trigger DoS conditions, allowing authenticated users to exploit validation gaps in GitLab. CVE-2024-7803 (CVSS 6.5): Discord webhook integration vulnerability may cause DoS, affecting all versions from 11.6 before the patched releases.

Research shows webhook functionality in GitLab can be misused for DoS attacks. A bug report highlights the absence of rate limits on gitlab.com webhook functions, enabling attackers to flood victim servers with requests.

Advertisement

Upgrade immediately: Ensure all installations running affected versions are promptly upgraded to the latest version. Apply proper input validation: Address vulnerabilities arising from inadequate input validation, especially for blobs, notes positions, and Kubernetes tokens. Monitor system resources: During potential attacks, monitor CPU and memory usage to identify exploitation attempts. Tools like htop and dmesg -T -w can assist in diagnostics. Consider object storage configuration: For large instances, configure object storage with appropriate limits to mitigate blob-related attacks.

These vulnerabilities highlight the challenges of securing complex DevOps platforms against resource exhaustion attacks, especially when managing large binary objects and external integrations.

Based on reporting by Cyber Security News.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026