Scanner gratuitement

Cette page n'a pas encore été traduite dans votre langue. Affichage du contenu en anglais pendant que nous y travaillons.

💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.

HIGHCVE-2025-14870CVSS 7.5

CVE-2025-14870: DoS in GitLab

Plateforme

gitlab

Composant

gitlab

Corrigé dans

18.11.3

Voir sur NVD
Sauvegarder
Traduction vers votre langue…

CVE-2025-14870 describes a denial-of-service (DoS) vulnerability discovered in GitLab Community Edition (CE) and Enterprise Edition (EE). This flaw allows an unauthenticated attacker to disrupt GitLab services by sending specially crafted JSON payloads. The vulnerability impacts versions 18.5.0 through 18.11.3, and a fix is available in version 18.11.3.

Impact et Scénarios d'Attaquetraduction en cours…

Successful exploitation of CVE-2025-14870 can lead to a denial of service, rendering GitLab unavailable to legitimate users. An attacker can easily trigger this vulnerability without authentication, making it a significant risk. The impact extends to all GitLab users, potentially disrupting development workflows, CI/CD pipelines, and access to project repositories. While the vulnerability doesn't directly expose sensitive data, prolonged denial of service can indirectly impact data integrity and availability if critical operations are halted.

Contexte d'Exploitationtraduction en cours…

CVE-2025-14870 is currently not listed on KEV (Known Exploited Vulnerabilities). The EPSS (Exploit Prediction Scoring System) score is pending evaluation. Public proof-of-concept (POC) code has not been widely reported, but the ease of exploitation (unauthenticated access) suggests a potential for future exploitation. The vulnerability was published on 2026-05-14.

Renseignement sur les Menaces

Statut de l'Exploit

Preuve de ConceptInconnu
CISA KEVNO
Exposition InternetÉlevée

Vecteur CVSS

RENSEIGNEMENT SUR LES MENACES· CVSS 3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H7.5HIGHAttack VectorNetworkComment l'attaquant atteint la cibleAttack ComplexityLowConditions requises pour exploiterPrivileges RequiredNoneNiveau d'authentification requisUser InteractionNoneSi une action de la victime est requiseScopeUnchangedImpact au-delà du composant affectéConfidentialityNoneRisque d'exposition de données sensiblesIntegrityNoneRisque de modification non autorisée de donnéesAvailabilityHighRisque d'interruption de servicenextguardhq.com · Score de base CVSS v3.1
Que signifient ces métriques?
Attack Vector
Réseau — exploitable à distance via internet. Aucun accès physique ou local requis.
Attack Complexity
Faible — aucune condition spéciale requise. Exploitable de manière fiable.
Privileges Required
Aucun — sans authentification. Aucune identifiant requis pour exploiter.
User Interaction
Aucune — attaque automatique et silencieuse. La victime ne fait rien.
Scope
Inchangé — impact limité au composant vulnérable.
Confidentiality
Aucun — aucun impact sur la confidentialité.
Integrity
Aucun — aucun impact sur l'intégrité.
Availability
Élevé — panne complète ou épuisement des ressources. Déni de service total.

Logiciel Affecté

Composantgitlab
FournisseurGitLab
Version minimale18.5.0
Version maximale18.11.3
Corrigé dans18.11.3

Classification de Faiblesse (CWE)

CWE-770

Chronologie

  1. Réservé
  2. Publiée

Mitigation et Contournementstraduction en cours…

The primary mitigation for CVE-2025-14870 is to upgrade GitLab to version 18.11.3 or later. If immediate upgrade is not feasible, consider implementing rate limiting on incoming JSON requests to the GitLab API. Web Application Firewalls (WAFs) can be configured to detect and block malicious JSON payloads. Monitor GitLab logs for unusual activity or errors related to JSON parsing, which could indicate exploitation attempts. After upgrading, confirm the fix by attempting to send a crafted JSON payload and verifying that GitLab does not crash or become unresponsive.

Comment corrigertraduction en cours…

Actualice GitLab a la versión 18.9.7 o superior, 18.10.6 o superior, o 18.11.3 o superior para mitigar la vulnerabilidad. Esta actualización aborda la falta de validación de entrada que permitía a usuarios no autenticados causar una denegación de servicio a través de payloads JSON maliciosos.

Questions fréquentestraduction en cours…

What is CVE-2025-14870 — DoS in GitLab?

CVE-2025-14870 is a denial-of-service vulnerability in GitLab CE/EE allowing unauthenticated attackers to disrupt service with crafted JSON payloads. It affects versions 18.5.0–18.11.3 and has a CVSS score of 7.5 (HIGH).

Am I affected by CVE-2025-14870 in GitLab?

You are affected if you are running GitLab CE/EE versions 18.5.0 through 18.11.3. Verify your GitLab version using gitlab-ctl version and upgrade if necessary.

How do I fix CVE-2025-14870 in GitLab?

Upgrade GitLab to version 18.11.3 or later. As a temporary workaround, implement rate limiting on incoming JSON requests and monitor logs for suspicious activity.

Is CVE-2025-14870 being actively exploited?

While no widespread exploitation has been publicly reported, the vulnerability's ease of exploitation suggests a potential for future attacks. Monitor your GitLab instance for unusual activity.

Where can I find the official GitLab advisory for CVE-2025-14870?

Refer to the official GitLab security advisory for CVE-2025-14870 on the GitLab website: [https://about.gitlab.com/security/advisories/](https://about.gitlab.com/security/advisories/)

Ton projet est-il affecté ?

Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.

Scanner gratuitementRechercher des CVE
en directfree scan

Essayez maintenant — sans compte

scanZone.subtitle

Scan manuelSlack/email alertsContinuous monitoringWhite-label reports

Glissez-déposez votre fichier de dépendances

composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...