CVE-2025-13690Patch(gitlab / gitlab)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch gitlab gitlab systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to cause a denial of service condition due to improper input validation on webhook custom header names under certain conditions.

gitlab CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/

Other references

Weakness type (CWE)

CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

gitlab

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-03-11); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

gitlab

Products

gitlab

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

Patch

250.0%

Disclosure

125.0%

General

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-11	3	Disclosure1General1Patch1
2026-03-15	1	Patch1

Full discourse4 posts

Orizon@OrizonCyber211d
Patch
🚨 GitLab CVE-2025-13690: authenticated users can DoS your instance via resource exhaustion No throttling = amateur hour Patch 18.7.6/18.8.6/18.9.2 NOW #infosec #CVE https://t.co/ZzfHy4vslW
Post summary
The tweet alerts about CVE-2025-13690, noting that authenticated users can cause a DoS via resource exhaustion, and urges users to apply the newly released patches 18.7.6/18.8.6/18.9.2.
10010136
5 followersView on X
CVE@CVEnew208d
Patch
CVE-2025-13690 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.11 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an … https://www.cve.org/CVERecord?id=CVE-2025-13690
Post summary
GitLab has released a remediation for CVE‑2025‑13690 affecting multiple CE/EE versions, but the post offers no PoC, exploit details, or evidence of active exploitation.
00000253
56.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds211d
Disclosure
CVE-2025-13690 Authenticated Denial of Service in GitLab CE/EE via Webhook Header Validation https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-13690
Post summary
The snippet announces a new authenticated denial‑of‑service vulnerability (CVE‑2025‑13690) in GitLab CE/EE involving webhook header validation, but provides no PoC, exploit, patch, or active exploitation details.
0000018
4.0K followersView on X
Orizon@OrizonCyber211d
General
🔗 Source: https://cvefeed.io/vuln/detail/CVE-2025-13690
Post summary
The provided text only contains a link to a CVE detail page with no additional information about the vulnerability, PoC, exploit, or mitigation.
00000113
5 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	gitlab	gitlab	-	-	-
App	gitlab	gitlab	-	-	-

Explore more

Back to dashboard gitlab CVEs gitlab vulnerabilities

What researchers are saying

CVE-2025-13690

Orizon[verified]@OrizonCyberPatch

The tweet alerts about CVE-2025-13690, noting that authenticated users can cause a DoS via resource exhaustion, and urges users to apply the newly released patches 18.7.6/18.8.6/18.9.2.

Orizon[verified]@OrizonCyberGeneral

The provided text only contains a link to a CVE detail page with no additional information about the vulnerability, PoC, exploit, or mitigation.

CVE@CVEnewPatch

GitLab has released a remediation for CVE‑2025‑13690 affecting multiple CE/EE versions, but the post offers no PoC, exploit details, or evidence of active exploitation.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The snippet announces a new authenticated denial‑of‑service vulnerability (CVE‑2025‑13690) in GitLab CE/EE involving webhook header validation, but provides no PoC, exploit, patch, or active exploitation details.