此页面尚未翻译为您的语言。我们正在努力翻译，目前显示英文内容。
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2025-14870 describes a denial-of-service (DoS) vulnerability discovered in GitLab Community Edition (CE) and Enterprise Edition (EE). This flaw allows an unauthenticated attacker to disrupt GitLab services by sending specially crafted JSON payloads. The vulnerability impacts versions 18.5.0 through 18.11.3, and a fix is available in version 18.11.3.
影响与攻击场景翻译中…
Successful exploitation of CVE-2025-14870 can lead to a denial of service, rendering GitLab unavailable to legitimate users. An attacker can easily trigger this vulnerability without authentication, making it a significant risk. The impact extends to all GitLab users, potentially disrupting development workflows, CI/CD pipelines, and access to project repositories. While the vulnerability doesn't directly expose sensitive data, prolonged denial of service can indirectly impact data integrity and availability if critical operations are halted.
利用背景翻译中…
CVE-2025-14870 is currently not listed on KEV (Known Exploited Vulnerabilities). The EPSS (Exploit Prediction Scoring System) score is pending evaluation. Public proof-of-concept (POC) code has not been widely reported, but the ease of exploitation (unauthenticated access) suggests a potential for future exploitation. The vulnerability was published on 2026-05-14.
威胁情报
漏洞利用状态
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 无 — 无需认证，无需凭证即可利用。
- User Interaction
- 无 — 攻击自动且无声，受害者无需任何操作。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 无 — 无机密性影响。
- Integrity
- 无 — 无完整性影响。
- Availability
- 高 — 完全崩溃或资源耗尽，完全拒绝服务。
受影响的软件
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
缓解措施和替代方案翻译中…
The primary mitigation for CVE-2025-14870 is to upgrade GitLab to version 18.11.3 or later. If immediate upgrade is not feasible, consider implementing rate limiting on incoming JSON requests to the GitLab API. Web Application Firewalls (WAFs) can be configured to detect and block malicious JSON payloads. Monitor GitLab logs for unusual activity or errors related to JSON parsing, which could indicate exploitation attempts. After upgrading, confirm the fix by attempting to send a crafted JSON payload and verifying that GitLab does not crash or become unresponsive.
修复方法翻译中…
Actualice GitLab a la versión 18.9.7 o posterior, 18.10.6 o posterior, o 18.11.3 o posterior para mitigar la vulnerabilidad. Esta actualización aborda la falta de validación de entrada que permitía a usuarios no autenticados causar una denegación de servicio a través de payloads JSON maliciosos.
常见问题翻译中…
What is CVE-2025-14870 — DoS in GitLab?
CVE-2025-14870 is a denial-of-service vulnerability in GitLab CE/EE allowing unauthenticated attackers to disrupt service with crafted JSON payloads. It affects versions 18.5.0–18.11.3 and has a CVSS score of 7.5 (HIGH).
Am I affected by CVE-2025-14870 in GitLab?
You are affected if you are running GitLab CE/EE versions 18.5.0 through 18.11.3. Verify your GitLab version using gitlab-ctl version and upgrade if necessary.
How do I fix CVE-2025-14870 in GitLab?
Upgrade GitLab to version 18.11.3 or later. As a temporary workaround, implement rate limiting on incoming JSON requests and monitor logs for suspicious activity.
Is CVE-2025-14870 being actively exploited?
While no widespread exploitation has been publicly reported, the vulnerability's ease of exploitation suggests a potential for future attacks. Monitor your GitLab instance for unusual activity.
Where can I find the official GitLab advisory for CVE-2025-14870?
Refer to the official GitLab security advisory for CVE-2025-14870 on the GitLab website: [https://about.gitlab.com/security/advisories/](https://about.gitlab.com/security/advisories/)
立即试用 — 无需账户
上传任何清单文件 (composer.lock, package-lock.json, WordPress 插件列表…) 或粘贴您的组件列表。您立即获得一份漏洞报告。上传文件只是开始：拥有账户后，您将获得持续监控、Slack/电子邮件警报、多项目和白标报告。
拖放您的依赖文件
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...