CVE-2025-1072

Published: Feb 7, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5 prior to 17.5.2. A denial of service could occur upon importing maliciously crafted content using the Fogbugz importer.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	17.4.0 ≤ version < 17.4.4
Gitlab Gitlab	17.5.0 ≤ version < 17.5.2
Gitlab Gitlab	7.14.1 ≤ version < 17.3.7
Gitlab Gitlab	17.5.0 ≤ version < 17.5.2
Gitlab Gitlab	17.7.0 ≤ version < 17.7.3
Gitlab Gitlab	7.14.1 ≤ version < 17.3.7

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (3)

https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#denial-of-service-by-importing-malicious-crafted-fogbugz-import-payload

Source: cve@gitlab.com

Release Notes

https://gitlab.com/gitlab-org/gitlab/-/issues/463093

Source: cve@gitlab.com

Broken Link

https://hackerone.com/reports/2504059

Source: cve@gitlab.com

Permissions Required

Timeline

No history available yet.