Advisories
GitLab 18.3.1/18.2.5/18.1.5 Patch Addresses Medium‑Severity Resource Allocation Vulnerability
GitLab released patch versions 18.3.1, 18.2.5, and 18.1.5 on August 27, 2025 to fix a medium‑severity resource‑allocation flaw in the import function that could allow an attacker to exhaust system resources. All self‑managed CE and EE installations must upgrade immediately; GitLab.com and Dedicated customers are already protected.
What Happened
On August 27, 2025 GitLab issued patch releases 18.3.1, 18.2.5, and 18.1.5 for both Community Edition (CE) and Enterprise Edition (EE). The updates contain a fix for a medium‑severity vulnerability in the import function that allowed an attacker to allocate resources without limits, potentially leading to denial‑of‑service conditions.
Impact
All self‑managed installations running any of the affected versions are susceptible. The flaw could be triggered by a crafted import request and could consume CPU, memory, or disk I/O, degrading or halting GitLab services. GitLab.com is already running the patched version, and Dedicated customers do not need to take action.
Recommended Action
Defenders should immediately upgrade to the latest patch for their supported GitLab version:
- CE: upgrade to 18.3.1, 18.2.5, or 18.1.5
- EE: upgrade to 18.3.1, 18.2.5, or 18.1.5
Verify the upgrade by checking the version displayed in the GitLab UI or via the API. After upgrading, monitor system metrics for abnormal resource usage and review import logs for any suspicious activity.
Additional Notes
GitLab follows a bi‑weekly patch schedule; future critical patches will be released as ad‑hoc updates. All customers are encouraged to maintain good security hygiene by applying patches promptly.
Related vulnerabilities
GitLab CE/EE Patch 19.0.1, 18.11.4, 18.10.7 – Immediate Upgrade Required
GitLab released critical security patches for CE and EE on May 27 2026. The update addresses a high‑severity improper access control flaw in Duo AI workflow runners that could allow unauthorized access and potential denial of service. All self‑managed installations should upgrade immediately; GitLab.com and Dedicated customers are already protected.
Read briefing
GitLab 16.9.8 Patch Release: Bug Fixes, No Security Updates
On May 9 2024 GitLab released 16.9.8 for Community and Enterprise Editions. The update addresses regressions and bugs but contains no security fixes. Defenders should apply the patch, review the auto‑reconfigure behavior, and use /etc/gitlab/skip‑auto‑reconfigure to avoid downtime in multi‑node setups.
Read briefing
Windows SMB Server DoS Vulnerability (CVE‑2026‑70133) – Immediate Patch Required
An unbounded resource allocation flaw in Windows SMB Server lets remote attackers trigger a denial‑of‑service. The vulnerability affects all Windows Server editions that run SMB. Microsoft has released a patch; administrators should apply it immediately and consider disabling SMB where possible.
Read briefing
GitLab 19.2.1/19.1.3/19.0.5 Patch: Sensitive Info Exposure & Mass Assignment Fixes
GitLab released critical patch versions 19.2.1, 19.1.3, and 19.0.5 on July 29, 2026, addressing a high‑severity sensitive information exposure in Workhorse and a mass‑assignment vulnerability. All self‑managed CE and EE deployments must upgrade immediately; GitLab.com and Dedicated customers are already patched.
Read briefing