Deze pagina is nog niet vertaald naar uw taal. We werken eraan — de inhoud wordt voorlopig in het Engels weergegeven.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2025-14870: DoS in GitLab
Platform
gitlab
Component
gitlab
Opgelost in
18.11.3
CVE-2025-14870 describes a denial-of-service (DoS) vulnerability discovered in GitLab Community Edition (CE) and Enterprise Edition (EE). This flaw allows an unauthenticated attacker to disrupt GitLab services by sending specially crafted JSON payloads. The vulnerability impacts versions 18.5.0 through 18.11.3, and a fix is available in version 18.11.3.
Impact en Aanvalsscenarioswordt vertaald…
Successful exploitation of CVE-2025-14870 can lead to a denial of service, rendering GitLab unavailable to legitimate users. An attacker can easily trigger this vulnerability without authentication, making it a significant risk. The impact extends to all GitLab users, potentially disrupting development workflows, CI/CD pipelines, and access to project repositories. While the vulnerability doesn't directly expose sensitive data, prolonged denial of service can indirectly impact data integrity and availability if critical operations are halted.
Uitbuitingscontextwordt vertaald…
CVE-2025-14870 is currently not listed on KEV (Known Exploited Vulnerabilities). The EPSS (Exploit Prediction Scoring System) score is pending evaluation. Public proof-of-concept (POC) code has not been widely reported, but the ease of exploitation (unauthenticated access) suggests a potential for future exploitation. The vulnerability was published on 2026-05-14.
Dreigingsinformatie
Exploit Status
CVSS-vector
Wat betekenen deze metrics?
- Attack Vector
- Netwerk — op afstand uitbuitbaar via internet. Geen fysieke of lokale toegang vereist.
- Attack Complexity
- Laag — geen speciale voorwaarden vereist. Betrouwbaar uitbuitbaar.
- Privileges Required
- Geen — geen authenticatie vereist om te exploiteren.
- User Interaction
- Geen — automatische en stille aanval. Slachtoffer doet niets.
- Scope
- Ongewijzigd — impact beperkt tot het kwetsbare component.
- Confidentiality
- Geen — geen vertrouwelijkheidsimpact.
- Integrity
- Geen — geen integriteitsimpact.
- Availability
- Hoog — volledige crash of uitputting van resources. Totale denial of service.
Getroffen Software
Zwakheidsclassificatie (CWE)
Tijdlijn
- Gereserveerd
- Gepubliceerd
Mitigatie en Workaroundswordt vertaald…
The primary mitigation for CVE-2025-14870 is to upgrade GitLab to version 18.11.3 or later. If immediate upgrade is not feasible, consider implementing rate limiting on incoming JSON requests to the GitLab API. Web Application Firewalls (WAFs) can be configured to detect and block malicious JSON payloads. Monitor GitLab logs for unusual activity or errors related to JSON parsing, which could indicate exploitation attempts. After upgrading, confirm the fix by attempting to send a crafted JSON payload and verifying that GitLab does not crash or become unresponsive.
Hoe te verhelpenwordt vertaald…
Actualice GitLab a la versión 18.9.7 o superior, 18.10.6 o superior, o 18.11.3 o superior para mitigar la vulnerabilidad. Esta actualización aborda la falta de validación de entrada que permitía a usuarios no autenticados causar una denegación de servicio a través de payloads JSON maliciosos.
Veelgestelde vragenwordt vertaald…
What is CVE-2025-14870 — DoS in GitLab?
CVE-2025-14870 is a denial-of-service vulnerability in GitLab CE/EE allowing unauthenticated attackers to disrupt service with crafted JSON payloads. It affects versions 18.5.0–18.11.3 and has a CVSS score of 7.5 (HIGH).
Am I affected by CVE-2025-14870 in GitLab?
You are affected if you are running GitLab CE/EE versions 18.5.0 through 18.11.3. Verify your GitLab version using gitlab-ctl version and upgrade if necessary.
How do I fix CVE-2025-14870 in GitLab?
Upgrade GitLab to version 18.11.3 or later. As a temporary workaround, implement rate limiting on incoming JSON requests and monitor logs for suspicious activity.
Is CVE-2025-14870 being actively exploited?
While no widespread exploitation has been publicly reported, the vulnerability's ease of exploitation suggests a potential for future attacks. Monitor your GitLab instance for unusual activity.
Where can I find the official GitLab advisory for CVE-2025-14870?
Refer to the official GitLab security advisory for CVE-2025-14870 on the GitLab website: [https://about.gitlab.com/security/advisories/](https://about.gitlab.com/security/advisories/)
Is jouw project getroffen?
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Probeer het nu — geen account
Upload een manifest (composer.lock, package-lock.json, WordPress pluginlijst…) of plak uw componentenlijst. U ontvangt direct een kwetsbaarheidsrapport. Een bestand uploaden is slechts het begin: met een account krijgt u continue monitoring, Slack/e-mail alerts, multi-project en white-label rapporten.
Sleep uw afhankelijkheidsbestand hierheen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...