CVE-2025-13929

Received Received - Intake

Denial of Service in GitLab Repository Archive Endpoints

Publication date: 2026-03-11

Last updated on: 2026-03-13

Assigner: GitLab Inc.

Description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an unauthenticated user to cause a denial of service by issuing specially crafted requests to repository archive endpoints under certain conditions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-11

Last Modified

2026-03-13

Generated

2026-07-06

AI Q&A

2026-03-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-13929

EUVD

EUVD-2025-208575

Affected Vendors & Products

Vendor	Product	Version / Range
gitlab	gitlab	From 18.8.0 (inc) to 18.8.6 (exc)
gitlab	gitlab	From 18.9.0 (inc) to 18.9.2 (exc)
gitlab	gitlab	From 18.8.0 (inc) to 18.8.6 (exc)
gitlab	gitlab	From 18.9.0 (inc) to 18.9.2 (exc)
gitlab	gitlab	From 10.0.0 (inc) to 18.7.6 (exc)
gitlab	gitlab	From 10.0.0 (inc) to 18.7.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in GitLab CE/EE affects versions from 10.0 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2. It allows an unauthenticated user to cause a denial of service by sending specially crafted requests to repository archive endpoints under certain conditions.

Impact Analysis

The impact of this vulnerability is a denial of service (DoS) condition. An attacker who is not authenticated can exploit this issue to disrupt the availability of the GitLab service by targeting repository archive endpoints, potentially causing service interruptions.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, you should upgrade GitLab CE/EE to a fixed version. Specifically, update to version 18.7.6 or later if you are using the 18.7 series, 18.8.6 or later if using the 18.8 series, or 18.9.2 or later if using the 18.9 series. This will prevent unauthenticated users from causing a denial of service via specially crafted requests to repository archive endpoints.

Hi! I’m here to help you understand CVE-2025-13929. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70