CVE-2025-14511
📋 TL;DR
An unauthenticated attacker can cause denial of service in GitLab by sending specially crafted files to the container registry event endpoint. This affects all GitLab CE/EE installations with vulnerable versions, potentially disrupting service availability.
💻 Affected Systems
- GitLab Community Edition
- GitLab Enterprise Edition
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability for all GitLab users, disrupting development workflows, CI/CD pipelines, and container registry operations.
Likely Case
Temporary service degradation or outages affecting container registry functionality and related services.
If Mitigated
Minimal impact with proper network controls and rate limiting in place.
🎯 Exploit Status
Exploitation requires sending crafted files to specific endpoint but no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.7.5, 18.8.5, or 18.9.1
Vendor Advisory: https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/
Restart Required: Yes
Instructions:
1. Backup GitLab instance. 2. Update to patched version using package manager. 3. Restart GitLab services. 4. Verify update completed successfully.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict access to container registry endpoints to trusted IPs only
# Configure firewall rules to limit access to /api/v4/container_registry_event
Rate Limiting
linuxImplement rate limiting on container registry endpoints
# Configure nginx or load balancer rate limiting for vulnerable endpoints
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to GitLab container registry endpoints
- Deploy WAF with DoS protection rules and monitor for abnormal traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check GitLab version against affected ranges: 12.2-18.7.4, 18.8.0-18.8.4, or 18.9.0Check Version:
sudo gitlab-rake gitlab:env:info | grep 'GitLab version'Verify Fix Applied:
Confirm GitLab version is 18.7.5+, 18.8.5+, or 18.9.1+📡 Detection & Monitoring
Log Indicators:
- High volume of requests to /api/v4/container_registry_event
- Error logs showing malformed file processing failures
- Increased resource utilization alerts
Network Indicators:
- Unusual traffic patterns to container registry endpoints
- Multiple connection attempts from single IPs
- Large file uploads to registry event endpoint
SIEM Query:
source="gitlab" AND (uri_path="/api/v4/container_registry_event" AND status>=500) | stats count by src_ip