CVE-2025-12664Patch(gitlab / gitlab)

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch gitlab gitlab systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an unauthenticated user to cause denial of service by sending repeated GraphQL queries.

gitlab CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/

Other references

Weakness type (CWE)

CWE-1284

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

gitlab

Threat summary

Patch or workaround signal is available
5 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
Disclosure: 1 classified signal
Disclosures: 1 classified signal
Peaked 2d ago at 2 mentions (2026-04-08); latest day: 2
5 total mentions across 3 days

Affected systems

Vendors

gitlab

Products

gitlab

Deep dive

Activity timeline5 mentions / 3d

Signal classification3 categories

Patch

360.0%

Disclosure

120.0%

Disclosures

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-08	2	Patch2
2026-04-11	1	Disclosure1
2026-04-16	2	Disclosures1Patch1

Full discourse5 posts

Netlas.io@Netlas_io180d
Disclosure
CVE-2026-5173, CVE-2026-1092, CVE-2025-12664 and other: Vulnerabilities in GitLab CE and EE, up to 8.5 rating 🔥 Several vulnerabilities in GitLab could compromise code integrity and allow an unauthenticated user to cause denial of service. 👉https://nt.ls/QGxUF
Post summary
The text discloses several new GitLab vulnerabilities (CVE-2026-5173, CVE-2026-1092, CVE-2025-12664) with severity ratings up to 8.5, highlighting potential code integrity compromise and unauthenticated denial of service.
03045972
7.5K followersView on X
CERT-PY@CERTpy175d
Disclosures
⚠️ Vulnerabilidades en productos GitLab ❗ CVE-2026-5173 ❗ CVE-2026-1092 ❗ CVE-2025-12664 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-gitlab-9/ https://t.co/D1iCzaS7Aq
Post summary
The post enumerates three GitLab CVEs and directs readers to external links for further information, but does not provide PoC, exploit code, active usage reports, or patch details.
00030449
6.7K followersView on X
iototsecnews@iototsecnews176d
Patch
GitLab の脆弱性 CVE-2026-5173 などが FIX：コード・インジェクションと DoS 攻撃の恐れ https://iototsecnews.jp/2026/04/09/gitlab-patches-multiple-vulnerabilities-that-enables-dos-and-code-injection-attacks/ 今回の緊急アップデートの背景にあるのは、GitLab の内部システムにおけるアクセス制御の不備や、外部からの入力データに対する検証の甘さです。最も深刻な CVE-2026-5173 は、WebSocket 通信の不適切な制御に起因し、認証済みのユーザーに対してサーバ上での不正なコマンド実行を許すものです。また、不正な JSON データや大量のクエリによりシステムを停止させる DoS 攻撃の脆弱性 CVE-2026-1092／CVE-2025-12664 も、入力に対するチェック不足の問題です。ご利用のチームは、ご注意ください。 #CVE202512664 #CVE20259484 #CVE20261092 #CVE20261101 #CVE20261403 #CVE20261516 #CVE20261752 #CVE20262104 #CVE20262619 #CVE20264332 #CVE20264916 #CVE20265173 #GitLab #Vulnerability
Post summary
The piece announces that GitLab has released a patch for several vulnerabilities, notably CVE‑2026‑5173, and details technical aspects such as WebSocket‑based code injection and DoS risks via malformed JSON, urging teams to apply the update.
01000130
484 followersView on X
Infoflowcloud@infoflowcloud183d
Patch
🚨*CVE* CVE-2025-12664 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an… https://www.cve.org/CVERecord?id=CVE-2025-12664 ----- Traducción: CVE-2025-12664 Git… http://infoflow.cloud`
Post summary
The tweet announces that GitLab has remediated CVE-2025-12664 for various affected versions and links to the CVE record.
00000328
67 followersView on X
CVE@CVEnew183d
Patch
CVE-2025-12664 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have allowed an… https://www.cve.org/CVERecord?id=CVE-2025-12664
Post summary
GitLab has released a patch for CVE-2025-12664, fixing an undisclosed vulnerability that could have allowed exploitation; no PoC, exploit code, or evidence of active attacks is mentioned.
00000226
57.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	gitlab	gitlab	-	-	-
App	gitlab	gitlab	-	-	-

Explore more

Back to dashboard gitlab CVEs gitlab vulnerabilities

What researchers are saying

CVE-2025-12664

Netlas.io[verified]@Netlas_ioDisclosure

The text discloses several new GitLab vulnerabilities (CVE-2026-5173, CVE-2026-1092, CVE-2025-12664) with severity ratings up to 8.5, highlighting potential code integrity compromise and unauthenticated denial of service.

CERT-PY@CERTpyDisclosures

The post enumerates three GitLab CVEs and directs readers to external links for further information, but does not provide PoC, exploit code, active usage reports, or patch details.

iototsecnews@iototsecnewsPatch

The piece announces that GitLab has released a patch for several vulnerabilities, notably CVE‑2026‑5173, and details technical aspects such as WebSocket‑based code injection and DoS risks via malformed JSON, urging teams to apply the update.

Infoflowcloud@infoflowcloudPatch

The tweet announces that GitLab has remediated CVE-2025-12664 for various affected versions and links to the CVE record.

CVE@CVEnewPatch

GitLab has released a patch for CVE-2025-12664, fixing an undisclosed vulnerability that could have allowed exploitation; no PoC, exploit code, or evidence of active attacks is mentioned.