CVE-2025-10903
GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user could have caused denial of service, due to an unbounded loop triggered by specially crafted input in the SCIM user provisioning feature.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 0.41%
- CWE
- CWE-835
- Published
- 2026-08-26
- Last modified
- 2026-08-26
Affected products
- GitLab GitLab
- GitLab GitLab
- GitLab GitLab
Weakness type
Related vulnerabilities
- CVE-2026-88002 — Open WebUI: Any authenticated user can hang the server via a cyclic chat message history
- CVE-2026-88000 — Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
- CVE-2026-87013 — Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle
- CVE-2026-6554 — infinte loop in libpcap before 1.10.7
- CVE-2026-85730 — smol-toml: Denial of Service via malformed TOML documents
- CVE-2026-78543 — IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
- CVE-2026-84309 — pypdf: Possible infinite loop for TreeObject.insert_child
- CVE-2026-82605 — BareBones BBEdit Lasso Language Tokenizer infinite loop