CVE-2025-14870 describes a denial-of-service (DoS) vulnerability discovered in GitLab Community Edition (CE) and Enterprise Edition (EE). This flaw allows an unauthenticated attacker to disrupt GitLab services by sending specially crafted JSON payloads. The vulnerability impacts versions 18.5.0 through 18.11.3, and a fix is available in version 18.11.3.
Impact and Attack Scenarios
Successful exploitation of CVE-2025-14870 can lead to a denial of service, rendering GitLab unavailable to legitimate users. An attacker can easily trigger this vulnerability without authentication, making it a significant risk. The impact extends to all GitLab users, potentially disrupting development workflows, CI/CD pipelines, and access to project repositories. While the vulnerability doesn't directly expose sensitive data, prolonged denial of service can indirectly impact data integrity and availability if critical operations are halted.
Exploitation Context
CVE-2025-14870 is currently not listed on KEV (Known Exploited Vulnerabilities). The EPSS (Exploit Prediction Scoring System) score is pending evaluation. Public proof-of-concept (POC) code has not been widely reported, but the ease of exploitation (unauthenticated access) suggests a potential for future exploitation. The vulnerability was published on 2026-05-14.
Threat Intelligence
Exploit Status
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- None — no confidentiality impact. Attacker cannot read protected data.
- Integrity
- None — no integrity impact. Attacker cannot modify data.
- Availability
- High — complete crash or resource exhaustion. Full denial of service.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
Mitigation and Workarounds
The primary mitigation for CVE-2025-14870 is to upgrade GitLab to version 18.11.3 or later. If immediate upgrade is not feasible, consider implementing rate limiting on incoming JSON requests to the GitLab API. Web Application Firewalls (WAFs) can be configured to detect and block malicious JSON payloads. Monitor GitLab logs for unusual activity or errors related to JSON parsing, which could indicate exploitation attempts. After upgrading, confirm the fix by attempting to send a crafted JSON payload and verifying that GitLab does not crash or become unresponsive.
How to fix
Actualice GitLab a la versión 18.9.7 o superior, 18.10.6 o superior, o 18.11.3 o superior para mitigar la vulnerabilidad. Esta actualización aborda la falta de validación de entrada que permitía a usuarios no autenticados causar una denegación de servicio a través de payloads JSON maliciosos.
Frequently asked questions
What is CVE-2025-14870 — DoS in GitLab?
CVE-2025-14870 is a denial-of-service vulnerability in GitLab CE/EE allowing unauthenticated attackers to disrupt service with crafted JSON payloads. It affects versions 18.5.0–18.11.3 and has a CVSS score of 7.5 (HIGH).
Am I affected by CVE-2025-14870 in GitLab?
You are affected if you are running GitLab CE/EE versions 18.5.0 through 18.11.3. Verify your GitLab version using gitlab-ctl version and upgrade if necessary.
How do I fix CVE-2025-14870 in GitLab?
Upgrade GitLab to version 18.11.3 or later. As a temporary workaround, implement rate limiting on incoming JSON requests and monitor logs for suspicious activity.
Is CVE-2025-14870 being actively exploited?
While no widespread exploitation has been publicly reported, the vulnerability's ease of exploitation suggests a potential for future attacks. Monitor your GitLab instance for unusual activity.
Where can I find the official GitLab advisory for CVE-2025-14870?
Refer to the official GitLab security advisory for CVE-2025-14870 on the GitLab website: [https://about.gitlab.com/security/advisories/](https://about.gitlab.com/security/advisories/)
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Try it now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...