CVE-2025-10903

Published: Aug 26, 2026Modified: Aug 31, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: cve@gitlab.com (Secondary)

Description

GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the SCIM user provisioning feature.

Affected (3)

Products: Gitlab: Gitlab

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 11.1.0 to 19.1.7
Gitlab Gitlab	From 19.2.0 to 19.2.5
Gitlab Gitlab	Version 19.3.0

Related CWEs

Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (3)

https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-1-released/

Source: cve@gitlab.com

Release NotesVendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/work_items/571842

Source: cve@gitlab.com

Issue TrackingVendor Advisory

https://hackerone.com/reports/3292470

Source: cve@gitlab.com

Permissions RequiredThird Party Advisory

Timeline

No history available yet.