## Summary
GitLab remediated a GraphQL-related issue (CWE-770) where improper resource allocation limits in GraphQL complexity calculation could allow an unauthenticated user to trigger a denial of service under certain conditions. GitLab recommends upgrading self-managed GitLab CE/EE immediately.
## Technical Details
- The vulnerability is in GitLab’s GraphQL complexity calculation logic, specifically involving improper resource allocation limits.
- Under certain conditions, crafted GraphQL requests could cause excessive resource consumption leading to a denial of service.
- The issue is described as affecting GraphQL complexity calculation behavior, with impact limited to availability.
## Affected
- GitLab CE/EE versions from 18.4.6 before 19.1.8
- GitLab CE/EE versions 19.2 before 19.2.6
- GitLab CE/EE versions 19.3 before 19.3.2
## Impact
- Unauthenticated (PR:N, UI:N) attacker can trigger denial of service.
- Availability impact is indicated as A:H with no confidentiality or integrity impact reported.
## Mitigation
1. Upgrade self-managed GitLab CE/EE to one of the patched versions: 19.3.2, 19.2.6, or 19.1.8.
2. If you cannot upgrade immediately, follow GitLab’s security best practices for hardening and monitoring (as referenced in the release patch guidance) until the upgrade is completed.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770