Main Vulnerability Database Vulnerabilities #VU114070

Inefficient regular expression complexity in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2025-2937

Published: August 14, 2025

Vulnerability identifier: #VU114070

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-2937

CWE-ID: CWE-1333

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to inefficient regular expression complexity issue in wiki. A remote user can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Affected software

Gitlab Community Edition
GitLab Enterprise Edition

How to mitigate CVE-2025-2937

Install updates from vendor's website.

Gitlab Community Edition - addressed in versions 18.0.6, 18.1.4, 18.2.2
GitLab Enterprise Edition - addressed in versions 18.0.6, 18.1.4, 18.2.2

External References

https://about.gitlab.com/releases/2025/08/13/patch-release-gitlab-18-2-2-released/

Related Security Bulletins