CVE-2025-13690
Denial of Service via Webhook Header Validation in GitLab
Publication date: 2026-03-11
Last updated on: 2026-03-13
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab | From 18.8.0 (inc) to 18.8.6 (exc) |
| gitlab | gitlab | From 18.9.0 (inc) to 18.9.2 (exc) |
| gitlab | gitlab | From 18.8.0 (inc) to 18.8.6 (exc) |
| gitlab | gitlab | From 18.9.0 (inc) to 18.9.2 (exc) |
| gitlab | gitlab | From 16.11.0 (inc) to 18.7.6 (exc) |
| gitlab | gitlab | From 16.11.0 (inc) to 18.7.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-13690 is a Denial of Service (DoS) vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). It is caused by improper input validation on webhook custom header names. An authenticated user could exploit this flaw to trigger a denial of service condition under certain circumstances by manipulating the webhook custom headers feature.
How can this vulnerability impact me? :
This vulnerability can impact you by causing a denial of service condition in your GitLab instance. It affects availability, meaning that an attacker with low privileges and no user interaction required can disrupt the normal operation of GitLab, potentially making the service unavailable to legitimate users.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2025-13690 vulnerability, users should immediately upgrade GitLab CE/EE to the patched versions 18.9.2, 18.8.6, or 18.7.6 depending on their current version.
Be aware that the patch release may include database migrations which could cause downtime during upgrade on single-node instances. Multi-node instances can achieve zero-downtime upgrades if properly configured.
Upgrading to these versions will remediate the denial of service vulnerability caused by improper input validation on webhook custom header names.